Multivariate time series data anomaly detection method and device based on time-frequency space graph network

Abstract

The present invention belongs to the technical field of abnormal data detection for industrial information systems, and specifically relates to a method and device for detecting anomalies in multivariate time series data based on a time-frequency-space graph network. The method comprises: constructing a data set based on multivariate time series data acquired by sensors, including a training set and a validation set constructed based on normal data, and a test set constructed based on data in an attack scenario; constructing a time-frequency-space graph network model, the model comprising a time series feature extraction module and a graph structure learning module, the time series feature extraction module being used to obtain node features with time series features, and the graph structure learning module being used to model the spatiotemporal dependency between node features; training the time-frequency-space graph network model using the training set, and calculating the anomaly score of the trained model on the test set, and comparing it with a set threshold to detect whether the data is abnormal. The present invention realizes anomaly detection of multivariate time series data.

Description

Technical Field

[0001] The present invention belongs to the technical field of abnormal data detection for industrial information systems, and specifically relates to a multivariate time series data anomaly detection method and device based on a time-frequency-space graph network. Background Art

[0002] With the continuous development of the Internet, the deep integration of the Internet and industry has broken the relatively closed environment of the traditional industrial field, transforming industrial control systems from independent systems to highly interconnected cyber-physical systems. They generate time series data from multiple devices or sensors to form complex multivariate time series. This not only leads to an explosive growth in the time series data collected by various industries and exposes them to network threats, but may also cause adverse effects such as physical damage to infrastructure.

[0003] To effectively monitor and provide early warnings for large-scale system operations, anomaly detection in multivariate time series has become a crucial research topic. However, in real-world applications and existing public datasets, anomaly data is often scarce, making data labeling challenging and costly. Therefore, to address this issue, unsupervised learning methods have become an important solution for anomaly detection in multivariate time series.

[0004] In recent years, unsupervised methods based on deep learning have been widely used and studied in the field of anomaly data detection. The difficulty in detecting anomalies in multivariate time series data lies in the complex relationships between pairs of variables. Early methods often employed statistical unsupervised models, but these methods cannot effectively capture the nonlinear spatiotemporal relationships of multivariate time series data. To explicitly capture the correlation between any two sensors, a common approach is to model the multivariate time series as a graph. Leveraging representative graphs, spatiotemporal graph neural networks can explicitly model pairwise correlations, thereby addressing the task of anomaly detection in multivariate time series.

[0005] Existing spatiotemporal graph neural networks begin by constructing a spatiotemporal graph, constructing a separate graph for each timestamp to represent the temporal and spatial relationships between sensors. To capture spatiotemporal dependencies, existing methods primarily combine graph convolutions with temporal encoders to capture spatial and temporal dependencies, respectively. However, in spatiotemporal data, spatial relationships and temporal dynamics are often coupled, limiting their ability to model the comprehensive spatiotemporal dependencies in multivariate time series data. These limitations suggest that existing models still need further improvement to more accurately detect outliers in multivariate time series data.

[0006] Chinese patent document CN119885029A discloses a multivariate time series data anomaly detection method based on spatiotemporal graph structure learning. The method preprocesses an acquired multivariate time series anomaly detection dataset; constructs an ST-GSLN multivariate time series anomaly detection model based on a multivariate time series coupling network; and trains the ST-GSLN multivariate time series anomaly detection model to obtain a trained ST-GSLN multivariate time series anomaly detection model. The trained ST-GSLN multivariate time series anomaly detection model then determines whether the multivariate time series data is anomaly and presents a detection result. This method, which integrates the spatiotemporal depth and structural features of the multivariate time series coupling network, can effectively overcome anomalies caused by time lag causality and further improve the robustness and adaptability of the multivariate time series data anomaly detection model.

[0007] Chinese patent document CN119885028A discloses a method for detecting anomalies in multivariate time series data using graph structure learning. The method involves preprocessing a constructed dataset to obtain a processed multivariate time series data sample dataset; constructing a multivariate time series data anomaly detection model (GSL-AD) using graph structure learning; training the GSL-AD model using training data to obtain a trained GSL-AD model; and performing graph structure learning-based anomaly detection on test data based on the trained GSL-AD model. The multivariate anomaly detection results are then visualized. This method improves the ability to represent the spatial structure of multivariate time series data, effectively overcomes anomalies caused by temporal dependency misalignment in multivariate time series data, and enhances the robustness and adaptability of the multivariate time series data anomaly detection model.

[0008] In view of this, the present invention designs a multivariate time series data anomaly detection method based on time-frequency space graph network to realize anomaly detection of multivariate time series data. Summary of the Invention

[0009] The present invention aims to overcome at least one of the above-mentioned defects of the prior art and provide a multivariate time series data anomaly detection method based on time-frequency space graph network.

[0010] The present invention also discloses a device loaded with a multivariate time series data anomaly detection method based on a time-frequency space graph network.

[0011] The detailed technical solutions of the present invention are as follows:

[0012] A multivariate time series data anomaly detection method based on a time-frequency-space graph network, the method comprising:

[0013] S1. Preprocess the multivariate time series data acquired by the sensor to construct a dataset;

[0014] The multivariate time series data includes normal data and data under attack scenarios, and the data set includes a training set and a validation set constructed based on the normal data, and a test set constructed based on the data under attack scenarios;

[0015] S2. Construct a time-frequency-space graph network model, which includes a time series feature extraction module and a graph structure learning module. The time series feature extraction module is used to obtain node features with time series features, including:

[0016] Extract time domain features of multivariate time series data through a multi-scale time series feature extractor;

[0017] Obtain frequency domain features of multivariate time series data through Fourier transform;

[0018] The time domain features and frequency domain features are concatenated to obtain node features with time series features;

[0019] The graph structure learning module is used to model the spatiotemporal dependencies between node features, including:

[0020] Introducing time position coding into the node features, and dividing the coded node features into several time segments;

[0021] For each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and symmetry weights;

[0022] Introducing a time causal mask into the initial adjacency matrix to obtain an intermediate adjacency matrix with time constraints;

[0023] performing sparsification on the intermediate adjacency matrix to obtain a target adjacency matrix;

[0024] Utilize message passing neural networks to propagate and update node features in the target adjacency matrix;

[0025] S3. Train the constructed time-frequency space-graph network model using the training set, calculate the anomaly score of the trained time-frequency space-graph network model on the test set, and compare it with the set threshold to detect whether the data is abnormal;

[0026] Wherein, a threshold is set according to the anomaly score of the trained time-frequency space-graph network model on the validation set.

[0027] Preferably, in S1, the preprocessing operation of the multivariate time series data includes data cleaning, feature selection and missing value processing, and normalization processing is performed on the preprocessed data:

[0028] (1);

[0029] In formula (1): represents the normalized data; Represents the preprocessed data; Respectively represent the maximum and minimum values ​​of the preprocessed data;

[0030] Construct a dataset based on normalized multivariate time series data;

[0031] When constructing the data set, the window is sliced ​​and slid according to the time step to form multivariate time series window data. A multivariate time series is expressed as:

[0032] (2);

[0033] (3);

[0034] In formulas (2) and (3): Represents multivariate time series data; express The observed value at the time; is a univariate, indicating the number of sensor features; Indicates the The sensors in Observed value at time.

[0035] Preferably, according to the present invention, in S2, the time domain features of the multivariate time series data are extracted by a multi-scale time series feature extractor, specifically:

[0036] (4);

[0037] (5);

[0038] In formulas (4) and (5): Represents the extracted multivariate time series data Time domain characteristics; represents a one-dimensional convolution operation; b is the batch size; T is the length of the time series; N is the number of sensors; Representing time domain features Dimensions;

[0039] For the Layer convolution and different convolution kernels Size, when When filling for:

[0040] (6);

[0041] when When filling for:

[0042] (7);

[0043] The frequency domain characteristics of multivariate time series data are obtained through Fourier transform, specifically:

[0044] (8);

[0045] In formula (8): 、 Represent the real part characteristics of the corresponding amplitude and the imaginary part characteristics of the corresponding phase, The dimension representing the real part feature; The dimension representing the imaginary part feature;

[0046] The time domain features and frequency domain features are spliced ​​together to obtain node features with time series features:

[0047] (9);

[0048] In formula (9): Represents node features with temporal features; Represents a splicing operation; Represents the final time series feature node dimension.

[0049] Preferably, according to the present invention, in S2, time position coding is introduced into the node features, and the coded node features are divided into several time segments, specifically including:

[0050] Add a time position code to each node feature , where T represents the length of the time series and d represents the feature dimension, which is expanded to , and the final encoding With node features Concatenate on the feature dimension:

[0051] (10);

[0052] In formula (10): Represents the node features after adding time position coding;

[0053] Node features after adding time position encoding Perform patching operations:

[0054] (11);

[0055] In formula (11): represents the lth time segment, represents the number of time segments, p represents the size of each time segment, and s represents the step size of the time segment.

[0056] Preferably, according to the present invention, in S2, for each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and the symmetry weight, specifically including:

[0057] The input features are projected into a low-rank space through the query and key mapping:

[0058] (12);

[0059] (13);

[0060] In formulas (12) and (13): for The elements in and For nonlinear mapping, the output ,in represents the input feature batch size, is a low-rank dimension;

[0061] Query-based and key , compute the symmetric and antisymmetric adjacency matrix components:

[0062] (14);

[0063] (15);

[0064] In formulas (14) and (15): is a symmetric adjacency matrix component; is the antisymmetric adjacency matrix component; is the transpose of the matrix;

[0065] The initial adjacency matrix By symmetry weight Fusion yields:

[0066] (16);

[0067] (17);

[0068] In formulas (16) and (17): is the sigmoid function; is a learnable symmetric weight parameter, through Map to the (0, 1) interval and generate a weight value;

[0069] For the initial adjacency matrix Any sub-block in , and the time step of the corresponding row is , the time step of the column is ; Mask matrix Defined as:

[0070] (18);

[0071] The initial adjacency matrix Multiply element-by-element with the mask matrix M to obtain the intermediate adjacency matrix with time constraints :

[0072] (19);

[0073] In formula (19): Indicates time Sensors at and time Sensors at The connection strength between

[0074] represents the sensor index in the multivariate time series, and N is the total number of sensors; represents the time step index within the time segment in the time series, and p is the size of the time segment;

[0075] The intermediate adjacency matrix is ​​sparsely processed to obtain the target adjacency matrix:

[0076] (20);

[0077] (twenty one);

[0078] In formulas (20) and (21): Indicates time Sensors at and time Sensors at A binary mask indicating whether to retain the connection. A value of 1 indicates retention and a value of 0 indicates discarding. represents the sparse threshold; represents the target adjacency matrix.

[0079] Preferably, according to the present invention, in S3, during the training phase of the time-frequency space-graph network model, the mean absolute error L1 Loss is used as the target loss function:

[0080] (twenty two);

[0081] In formula (22): b is the batch size; is the index of the sample in the batch; For samples True value; For samples Predicted value.

[0082] According to the preferred embodiment of the present invention, in said S3, during the testing phase of said time-frequency space-graph network model, for each single variable in the multivariate time series , calculate its absolute prediction error at the current timestamp T , and then perform robust normalization:

[0083] (twenty three);

[0084] In formula (23): represents the standardized absolute prediction error; represents the median of the error values; The interquartile range (IQR) value represents the error value;

[0085] For each single variable After normalization, the multivariate normalized error vector of the current timestamp T is obtained , and accordingly obtain the anomaly score AS of each test sample at the current timestamp T;

[0086] The obtained anomaly score AS is compared with the set threshold. If it is greater than the set threshold, the corresponding test sample is considered abnormal and the anomaly detection result is output.

[0087] In another aspect of the present invention, a device for implementing a multivariate time series data anomaly detection method based on a time-frequency-space graph network is provided, the device comprising:

[0088] The dataset construction module is used to preprocess the multivariate time series data acquired by the sensor to construct the dataset;

[0089] The multivariate time series data includes normal data and data under attack scenarios, and the data set includes a training set and a validation set constructed based on the normal data, and a test set constructed based on the data under attack scenarios;

[0090] A model construction module is used to construct a time-frequency-space graph network model. The time-frequency-space graph network model includes a time series feature extraction module and a graph structure learning module. The time series feature extraction module is used to obtain node features with time series features, including:

[0091] Extract time domain features of multivariate time series data through a multi-scale time series feature extractor;

[0092] Obtain frequency domain features of multivariate time series data through Fourier transform;

[0093] The time domain features and frequency domain features are concatenated to obtain node features with time series features;

[0094] The graph structure learning module is used to model the spatiotemporal dependencies between node features, including:

[0095] Introducing time position coding into the node features, and dividing the encoded node features into several time segments;

[0096] For each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and symmetry weights;

[0097] Introducing a time causal mask into the initial adjacency matrix to obtain an intermediate adjacency matrix with time constraints;

[0098] performing sparsification on the intermediate adjacency matrix to obtain a target adjacency matrix;

[0099] Utilize message passing neural networks to propagate and update node features in the target adjacency matrix;

[0100] A model training module is used to train the constructed time-frequency space-graph network model using the training set, and calculate the anomaly score of the trained time-frequency space-graph network model on the test set, and compare it with the set threshold to detect whether the data is abnormal;

[0101] Wherein, a threshold is set according to the anomaly score of the trained time-frequency space-graph network model on the validation set.

[0102] In another aspect of the present invention, an electronic device is provided, comprising:

[0103] at least one processor; and

[0104] A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the multivariate time series data anomaly detection method based on the time-frequency space graph network as described above.

[0105] In another aspect of the present invention, a machine-readable storage medium is provided, which stores executable instructions, and when the instructions are executed, the machine executes the multivariate time series data anomaly detection method based on the time-frequency space graph network as described above.

[0106] Compared with the prior art, the present invention has the following beneficial effects:

[0107] (1) The multivariate time series data anomaly detection method based on the time-frequency space graph network of the present invention extracts complementary features from the time domain and frequency domain respectively through an alternating filling strategy combined with multi-scale convolution kernels and fast Fourier transform (FFT), thereby enhancing the hierarchy and integrity of the features;

[0108] (2) This paper introduces temporal position encoding and patching operations, and proposes an improved dynamic graph structure learning method. By using learnable symmetry weights, it considers both the symmetric and asymmetric characteristics of the graph structure, explicitly models the correlation between all timestamps and sensors, and adaptively captures the complex spatiotemporal relationships between sensors.

[0109] (3) This invention introduces a temporal causal mask to ensure that the graph structure only retains connections that conform to temporal causality, thereby improving the model's ability to model the causal relationship of time series;

[0110] (4) The present invention combines a dynamic sparsification mechanism to filter noisy connections and generate a semantically rich sparse graph structure, thereby significantly improving the model's expressiveness, generalization ability, and ability to capture complex spatiotemporal data patterns, providing an efficient and robust solution for anomaly detection and spatiotemporal data analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0111] Figure 1 It is a flowchart of the multivariate time series data anomaly detection method based on time-frequency space graph network described in the present invention.

[0112] Figure 2 It is a module diagram of the time-frequency space-graph network model constructed in Example 1 of the present invention.

[0113] Figure 3 Schematic diagram of the dense adjacency matrix in Example 1 of the present invention.

[0114] Figure 4 Schematic diagram of the time-constrained adjacency matrix in Example 1 of the present invention.

[0115] Figure 5 This is a graph of anomaly detection results for multivariate time series data in Example 1 of the present invention. DETAILED DESCRIPTION

[0116] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0117] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0118] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0119] In the absence of conflict, the embodiments of the present invention and the features thereof may be combined with each other.

[0120] To address the shortcomings of existing technologies, the present invention provides a method for detecting anomalies in multivariate time series data based on a time-frequency spatial graph network. This method constructs a time-frequency spatial graph network model that, based on traditional multi-scale convolution kernel feature extraction methods, innovatively introduces an alternating padding strategy in the time domain. This dynamically adjusts the padding method to optimize temporal resolution, effectively balancing computational efficiency and feature integrity, and enhancing hierarchical feature extraction capabilities. Furthermore, the method converts data from the time domain to the frequency domain via a fast Fourier transform (FFT), capturing the data's periodic patterns and global frequency characteristics. These features complement the multi-scale convolution features in the time domain, providing rich time-frequency node features for subsequent graph structure learning.

[0121] To effectively capture the spatial characteristics of multivariate time series, this paper designs a graph structure learning module and proposes a dynamic and adaptive graph construction method that automatically generates a cross-timestamp and cross-sensor adjacency matrix based on the characteristics of the input data. In particular, by introducing a temporal causal mask, the adjacency matrix is ​​ensured to only retain connections that conform to temporal causal relationships, enhancing the model's ability to model time series causal relationships.

[0122] Furthermore, the constructed time-frequency spatial graph network model fully captures spatiotemporal dependencies through temporal position encoding, avoiding spatial and temporal information ambiguity. Learnable parameters (including symmetric weights and sparsity thresholds) further enable the model to flexibly model both symmetric (undirected) and asymmetric (directed) relationships. Dynamic filtering of noisy connections generates a semantically rich sparse graph structure, improving the model's versatility and robustness to diverse spatiotemporal data. Furthermore, the present invention ensures causal consistency of time series data through temporal causal masks and dynamic graph construction mechanisms.

[0123] The following is a further description of the multivariate time series data anomaly detection method and device based on the time-frequency space graph network of the present invention in conjunction with specific embodiments.

[0124] Example 1

[0125] Ginseng Figure 1This embodiment provides a multivariate time series data anomaly detection method based on a time-frequency space graph network, the method comprising:

[0126] S1. Preprocess the multivariate time series data acquired by the sensor to construct a dataset.

[0127] The multivariate time series data includes normal data and data in attack scenarios, and the data set includes a training set and a validation set constructed based on the normal data, and a test set constructed based on the data in the attack scenario.

[0128] In this example, we used a raw dataset consisting of 51 sensor data points simulating a real-world industrial water treatment plant. The sensor data is multivariate time series data. This raw dataset, collected at a timestamp per second, includes seven days of normal operation data and four days of attack scenario data.

[0129] The collected data are preprocessed, including data cleaning, feature selection and missing value processing.

[0130] The preprocessed data is normalized using MinMaxScaler:

[0131] (1);

[0132] In formula (1): represents the normalized data; Represents the preprocessed data; Represent the maximum and minimum values ​​of the preprocessed data respectively.

[0133] The normalized normal data is constructed as the training set. Furthermore, the last 20% of the training set is divided into the validation set. The normalized attack scenario data is constructed as the test set.

[0134] In this embodiment, when constructing a data set, window sliding slicing is performed according to the time step to form multivariate time series window data.

[0135] A multivariate time series can be represented as:

[0136] (2);

[0137] (3);

[0138] In formulas (2) and (3): Represents multivariate time series data; express The observed value at the time; is a univariate, indicating the number of sensor features; Indicates the The sensors in Observed value at time.

[0139] In this embodiment, the input data is the multivariate time series data SWaT of an industrial water treatment plant, where each element It is a tuple that includes the values ​​of 51 variables such as liquid level and flow rate.

[0140] S2. Construct a time-frequency space-time graph network model.

[0141] Ginseng Figure 2 In this embodiment, the Spatio-Frequency-Temporal Graph Network (SFTGN) model includes a temporal feature extraction module and a graph structure learning module.

[0142] Based on this, step S2 specifically includes:

[0143] S21. Obtain node features with time series features using a time series feature extraction module;

[0144] S22. Use the graph structure learning module to model the spatiotemporal dependency between node features.

[0145] Specifically, in step S21, due to the coupled nature of spatial relationships and temporal dynamics in multivariate time series (MTS) data, existing methods typically first perform graph structure learning on the raw data, then capture spatial and temporal dependencies through graph convolution and temporal convolution, respectively. This approach is fragmented when modeling spatiotemporal dependencies, resulting in insufficient information exchange. Therefore, to more effectively model the spatiotemporal dependencies of MTS, in this embodiment, temporal feature extraction is first performed on the multivariate time series (MTS) data, which includes the following operations.

[0146] S211. Extract time domain features of multivariate time series data through a multi-scale time series feature extractor.

[0147] Since MTS usually contains patterns of multiple time scales, such as short-term fluctuations and long-term trends, in order to effectively capture these multi-scale features, on the basis of traditional multi-scale feature extraction based on different convolution kernels, an alternating padding design is introduced to further adjust the temporal resolution based on multi-scale convolution and enhance the hierarchical feature extraction capability.

[0148] In this step, for the data , b is the batch size, T is the time series length, N is the number of sensors, and 1 represents the initial input To fully exploit the multi-scale temporal dependencies in sequences, this embodiment designs a multi-scale temporal feature extractor. This module uses multiple convolution branches with different convolution kernel sizes (e.g., 3 and 5) to model multi-granular temporal features and introduces an alternating padding strategy:

[0149] (4);

[0150] (5);

[0151] In formulas (4) and (5): Represents the extracted multivariate time series data Time domain characteristics; represents a one-dimensional convolution operation; b is the batch size; T is the length of the time series; N is the number of sensors; Representing time domain features Dimensions;

[0152] For the Layer convolution and different convolution kernels Size, when When filling for:

[0153] (6);

[0154] when When filling for:

[0155] (7).

[0156] This strategy differentially adjusts the receptive field coverage of each convolutional branch, enabling the model to perceive features of different temporal granularities across different channels, thereby achieving richer and more hierarchical temporal feature modeling. Compared to traditional fixed padding methods, this design not only retains the receptive field advantages of multi-scale convolution but also further enhances the perceptual diversity between feature channels, helping to improve the model's ability to model local and global temporal dependencies and enhance the expressiveness and robustness of feature representations.

[0157] S212. Obtain frequency domain features of multivariate time series data through Fourier transform.

[0158] In this example, to further capture the periodic patterns and global frequency characteristics in multivariate time series (MTS) data, the Fast Fourier Transform (FFT) is introduced as a supplementary means of time series feature extraction. The FFT converts the time series from the time domain to the frequency domain, generating the real part features corresponding to the amplitude and the imaginary part features corresponding to the phase:

[0159] (8);

[0160] In formula (8): 、 Represent the real part characteristics of the corresponding amplitude and the imaginary part characteristics of the corresponding phase, The dimension representing the real part feature; Dimension representing the imaginary part of the feature.

[0161] The aforementioned FFT transforms a time series from the time domain to the frequency domain, extracting the signal's frequency components, such as amplitude and phase information, thereby capturing periodic patterns and global frequency characteristics. These frequency domain features complement the multi-scale convolutional features in the time domain, enabling a more comprehensive characterization of the signal's dynamic behavior. This is particularly effective when processing data with periodic or oscillatory characteristics, such as sensor vibration signals. These high-dimensional, multi-scale spatiotemporal node features provide rich input for subsequent graph structure learning.

[0162] S213, the time domain features and frequency domain characteristics Splicing to obtain node features with time series features:

[0163] (9);

[0164] In formula (9): Represents node features with temporal features; Represents a splicing operation; Represents the final time series feature node dimension.

[0165] In step S22, to further enable the interaction of spatiotemporal relationships and avoid confusion in spatiotemporal information, a temporal position encoding is designed within the dynamic graph structure learning module. Taking both graph symmetry and asymmetry into account, the symmetric weights of the graph structure are adaptively learned to enhance the accuracy of spatiotemporal modeling. Finally, node features are updated through a message passing mechanism, integrating features from the time domain, frequency domain, and graph structure to achieve efficient spatiotemporal modeling of MTS. This includes the following operations.

[0166] S221 , introducing time position coding into the node features, and dividing the coded node features into several time segments.

[0167] In order to preserve the temporal dependency information of time series and enhance the model's ability to model temporal causal relationships during graph structure learning and message passing, a temporal position encoding is added to each node feature. , where T represents the length of the time series and d represents the feature dimension. It can be expanded to , and the final encoding With node features Concatenate on the feature dimension:

[0168] (10);

[0169] In formula (10): Represents the node features after adding time position encoding.

[0170] By encoding With node features Splicing along the feature dimension can effectively capture and represent the time dimension information.

[0171] Furthermore, in order to achieve fine-grained spatial modeling of MTS, the node features after adding time position coding are Perform patching operations:

[0172] (11);

[0173] In formula (11): represents the lth patch, represents the number of patches, p represents the size of each patch, and s represents the step size of the patch.

[0174] Afterwards, for each patch (time segment), graph structure learning and message passing are performed separately. The details are as follows.

[0175] S222. For each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and the symmetry weight.

[0176] In the graph structure learning module, since the relationship between variables in MTS is not absolutely symmetrical or asymmetrical, the method of this embodiment dynamically calculates the adjacency matrix through the attention mechanism and introduces a learnable weight to allow the model to adaptively learn the degree of symmetry of the relationship.

[0177] First, the input features are projected into a low-rank space through the query and key mapping:

[0178] (12);

[0179] (13);

[0180] In formulas (12) and (13): for The elements in and For nonlinear mapping, the output ,in represents the input feature batch size, is a low-rank dimension.

[0181] Query-based and key , compute the symmetric and antisymmetric adjacency matrix components:

[0182] (14);

[0183] (15);

[0184] In formulas (14) and (15): is a symmetric adjacency matrix component; is the antisymmetric adjacency matrix component; is the transpose of the matrix.

[0185] The final initial adjacency matrix By symmetry weight Fusion yields:

[0186] (16);

[0187] (17);

[0188] In formulas (16) and (17): is the sigmoid function; is a learnable symmetric weight parameter, through Map to the (0, 1) interval and generate a weight value.

[0189] Since industrial systems are usually executed in multiple serial processes, there is a delay in the time series, which can be understood as Moment Sensor data will affect Moment For sensor data, the state of the same sensor at the previous moment may also affect its state at the next moment. Therefore, it is different from other graph structure learning modules that treat different sensors as a graph node and generate an N×N adjacency matrix. This embodiment treats each sensor at each moment as a graph node and generates an initial adjacency matrix for The dense adjacency matrix consists of multiple sub-blocks Composition, its shape is Figure 3 shown.

[0190] S223 : Introducing a time causal mask into the initial adjacency matrix to obtain an intermediate adjacency matrix with time constraints.

[0191] Based on the actual situation, the data of the future time step should not affect the data of the previous time step to comply with the principle of causality. Therefore, the method of this embodiment designs a time constraint mask matrix , used to enforce temporal causality.

[0192] Specifically, for the initial adjacency matrix Any sub-block in , and the time step of the corresponding row is , the time step of the column is . Mask matrix Defined as:

[0193] (18);

[0194] Then the initial adjacency matrix Multiply element-by-element with the mask matrix M to obtain the intermediate adjacency matrix with time constraints :

[0195] (19);

[0196] In formula (19): Indicates time Sensors at and time Sensors at The connection strength between

[0197] represents the sensor index in the multivariate time series, and N is the total number of sensors. represents the time step index within a time slice in the time series, and p is the size of the time slice.

[0198] The intermediate adjacency matrix obtained The shape of Figure 4 shown.

[0199] S224: Sparsely process the intermediate adjacency matrix to obtain a target adjacency matrix.

[0200] In this embodiment, in order to reduce the required computational cost and reduce noise connections, it is necessary to generate the intermediate adjacency matrix Perform sparseness.

[0201] The most commonly used method is the Top-k sparsification method. However, it forces each row to retain a fixed number of edges, and the parameter k is a fixed hyperparameter that needs to be manually adjusted based on experience. This may result in the loss of important strong connections or the retention of weak connections. To this end, this embodiment design a sparsification method based on a learnable threshold:

[0202] (20);

[0203] (twenty one);

[0204] In formulas (20) and (21): Indicates time Sensors at and time Sensors at A binary mask indicating whether to retain the connection. A value of 1 indicates retention and a value of 0 indicates discarding. represents the sparse threshold; represents the target adjacency matrix.

[0205] Through the above-mentioned adaptive graph structure learning module, a more comprehensive spatiotemporal dependency modeling of MTS data is achieved.

[0206] S225. Use a message passing neural network to propagate and update node features in the target adjacency matrix.

[0207] The Message Passing Neural Network (MPNN) can fully capture the comprehensive spatiotemporal dependencies between nodes in the graph structure and update node features to reflect these dependencies.

[0208] Finally, a pooling operation is used to aggregate the features of each patch, reduce the dimensionality of the multi-dimensional features and extract key information to generate a more compact feature representation for subsequent prediction tasks.

[0209] S3. Use the training set to train the constructed time-frequency space-graph network model, and calculate the anomaly score of the trained time-frequency space-graph network model on the test set, and compare it with the set threshold to detect whether the data is abnormal.

[0210] Specifically, during the training phase of the SFTGN model, the multivariate time series data in the training set is input, and the model parameters are optimized by minimizing the prediction loss to obtain the trained SFTGN model. The target loss function is the mean absolute error (L1 Loss), which is used to measure the difference between the predicted value and the true value:

[0211] (twenty two);

[0212] In formula (22): b is the batch size; is the index of the sample in the batch; For samples True value; For samples Predicted value.

[0213] The AdamW optimizer combines the Adam optimization algorithm with weight decay (L2 regularization) to help prevent overfitting and improve the model's generalization. The ReduceLROnPlateau learning rate scheduler dynamically adjusts the learning rate based on changes in validation loss to help the model converge better.

[0214] During the testing phase of the Time-Frequency Spatial Graph Network (SFTGN) model, the SFTGN model can anticipate abnormal observations in the test set that significantly deviate from the learned pattern by effectively learning spatial and temporal dependencies from normal data. Since the individual variables in a multivariate time series often have very different properties and scales, each individual variable error needs to be normalized independently to prevent any single variable from dominating the overall multivariate error value.

[0215] Specifically, for each univariate in the multivariate time series , calculate its absolute prediction error at the current timestamp T , and then perform robust normalization:

[0216] (twenty three);

[0217] In formula (23): represents the standardized absolute prediction error; represents the median of the error values; Indicates the interquartile range (IQR) value of the error value.

[0218] For each single variable After normalization, the multivariate normalized error vector of the current timestamp T is obtained , and accordingly obtain the anomaly score AS of each test sample at the current timestamp T.

[0219] Then the anomaly score AS is compared with the set threshold The data is compared to detect whether it is abnormal. In this embodiment, if the abnormality score is greater than a set threshold, the corresponding test sample is considered abnormal and the abnormality detection result is output.

[0220] Furthermore, in this embodiment, 20% of the training set is divided as a validation set, and the threshold is automatically set by the anomaly score calculated by the model on the validation set.

[0221] Based on the above, the observations in the test set whose anomaly scores exceed the threshold are classified as anomalies and output.

[0222] The following comparative experiments are used to verify the effectiveness of this method.

[0223] This experiment uses the SWaT dataset generated from a scaled-down version of a real-world industrial water treatment plant. The dataset includes 51 features, 7 days of normal operation (training data) and 4 days of attack scenarios (test data). The experiment is based on Ubuntu 22.04 system, under Python 3.8 and cuda 11.7 environment. The experimental results are as follows: Figure 5 As shown in Figure 2, the detection results obtained by the anomaly scores and detection thresholds calculated in the experiment are shown.

[0224] At the same time, using the same dataset and environment, through the same data preprocessing process and the same training rounds, comparative experiments were conducted with Correlation-Aware Spatial–Temporal Graph Learning (CST-GL). ROC (area under the receiver operating characteristic curve) and PRC (area under the precision-recall curve) were used as evaluation indicators. ROC can intuitively demonstrate the model's ability to classify abnormal and normal samples, reflecting the model's overall discrimination performance and suitable for evaluating the model's robustness. PRC can more accurately evaluate the model's detection performance in rare anomaly scenarios, emphasizing the balance between precision and recall. Combining ROC and PRC can comprehensively evaluate the model's ability to detect abnormal data from different perspectives. The experimental results are shown in Table 1.

[0225] Table 1. Anomaly detection results for multivariate time series data

[0226]

[0227] As shown in Table 1, our proposed scheme significantly outperforms the baseline method CST-GL in anomaly detection on the SWaT dataset. Specifically, our proposed scheme achieves a receiver operating characteristic (ROC) score of 0.9528, an improvement of approximately 13.88% over CST-GL, and a performance ratio (PRC) score of 0.8404, an improvement of approximately 19.57% over CST-GL. This demonstrates that our proposed scheme achieves higher detection accuracy and robustness in the task of multivariate time series anomaly detection, more effectively capturing the complex temporal and spatial dependencies in multivariate time series, and thus significantly improving anomaly detection performance.

[0228] In summary, the multivariate time series data anomaly detection method based on the time-frequency space-time graph network of the present invention combines time-frequency feature extraction and adaptive graph learning to comprehensively capture the complex patterns in the data. Compared with the existing technology, it significantly improves the model's expressive power, generalization ability and anomaly detection performance, and provides an efficient and robust solution for complex spatiotemporal data analysis.

[0229] Example 2

[0230] This embodiment provides a device for implementing a method for detecting anomalies in multivariate time series data based on a time-frequency-space graph network, the device comprising:

[0231] The dataset construction module is used to preprocess the multivariate time series data acquired by the sensor to construct the dataset;

[0232] The multivariate time series data includes normal data and data under attack scenarios, and the data set includes a training set and a validation set constructed based on the normal data, and a test set constructed based on the data under attack scenarios;

[0233] A model construction module is used to construct a time-frequency-space graph network model. The time-frequency-space graph network model includes a time series feature extraction module and a graph structure learning module. The time series feature extraction module is used to obtain node features with time series features, including:

[0234] Extract time domain features of multivariate time series data through a multi-scale time series feature extractor;

[0235] Obtain frequency domain features of multivariate time series data through Fourier transform;

[0236] The time domain features and frequency domain features are concatenated to obtain node features with time series features;

[0237] The graph structure learning module is used to model the spatiotemporal dependencies between node features, including:

[0238] Introducing time position coding into the node features, and dividing the encoded node features into several time segments;

[0239] For each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and symmetry weights;

[0240] Introducing a time causal mask into the initial adjacency matrix to obtain an intermediate adjacency matrix with time constraints;

[0241] performing sparsification on the intermediate adjacency matrix to obtain a target adjacency matrix;

[0242] Utilize message passing neural networks to propagate and update node features in the target adjacency matrix;

[0243] A model training module is used to train the constructed time-frequency space-graph network model using the training set, and calculate the anomaly score of the trained time-frequency space-graph network model on the test set, and compare it with the set threshold to detect whether the data is abnormal;

[0244] Wherein, a threshold is set according to the anomaly score of the trained time-frequency space-graph network model on the validation set.

[0245] Example 3

[0246] This embodiment further provides an electronic device, including:

[0247] at least one processor;

[0248] and a memory storing instructions, which, when executed by the at least one processor, enable the at least one processor to execute the multivariate time series data anomaly detection method based on the time-frequency-space graph network as described above.

[0249] In this embodiment, electronic devices may include, but are not limited to: personal computers, server computers, workstations, desktop computers, laptop computers, notebook computers, mobile computing devices, smart phones, tablet computers, cellular phones, personal digital assistants (PDAs), handheld devices, messaging devices, wearable computing devices, consumer electronic devices, and the like.

[0250] Example 4

[0251] This embodiment also provides a machine-readable storage medium storing executable instructions, which, when executed, enable the machine to execute the multivariate time series data anomaly detection method based on the time-frequency space graph network as described above.

[0252] Specifically, a system or device equipped with a readable storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer or processor of the system or device can read and execute instructions stored in the readable storage medium.

[0253] In this case, the program code read from the machine-readable medium can itself implement the functions of any of the above-described embodiments. Therefore, the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification. Examples of machine-readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROMs, CD-Rs, CD-RWs, DVD-ROMs, DVD-RAMs, DVD-RWs, DVD-RWs), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer or the cloud via a communication network.

[0254] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0255] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0256] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0257] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0258] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation methods of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A multivariate time series data anomaly detection method based on time-frequency space graph network, characterized by: The method comprises: S1. Preprocess the multivariate time series data acquired by the sensor to construct a dataset; The multivariate time series data includes normal data and data under attack scenarios, and the data set includes a training set and a validation set constructed based on the normal data, and a test set constructed based on the data under attack scenarios; S2. Construct a time-frequency-space graph network model, which includes a time series feature extraction module and a graph structure learning module. The time series feature extraction module is used to obtain node features with time series features, including: Extract time domain features of multivariate time series data through a multi-scale time series feature extractor; Obtain frequency domain features of multivariate time series data through Fourier transform; The time domain features and frequency domain features are concatenated to obtain node features with time series features; The graph structure learning module is used to model the spatiotemporal dependencies between node features, including: Introducing time position coding into the node features, and dividing the coded node features into several time segments; For each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and symmetry weights; Introducing a time causal mask into the initial adjacency matrix to obtain an intermediate adjacency matrix with time constraints; performing sparsification on the intermediate adjacency matrix to obtain a target adjacency matrix; Utilize message passing neural networks to propagate and update node features in the target adjacency matrix; S3. Train the constructed time-frequency space-graph network model using the training set, calculate the anomaly score of the trained time-frequency space-graph network model on the test set, and compare it with the set threshold to detect whether the data is abnormal; Wherein, a threshold is set according to the anomaly score of the trained time-frequency space-graph network model on the validation set.

2. The multivariate time series data anomaly detection method based on time-frequency space graph network according to claim 1 is characterized in that: In S1, the preprocessing operations of the multivariate time series data include data cleaning, feature selection and missing value processing, and normalization processing is performed on the preprocessed data: (1)； In formula (1): represents the normalized data; Represents the preprocessed data; Respectively represent the maximum and minimum values ​​of the preprocessed data; Construct a dataset based on normalized multivariate time series data; When constructing the data set, the window is sliced ​​and slid according to the time step to form multivariate time series window data. A multivariate time series is expressed as: (2)； (3)； In formulas (2) and (3): Represents multivariate time series data; express The observed value at the time; is a single variable, indicating the number of sensors; Indicates the The sensors in Observed value at time.

3. The multivariate time series data anomaly detection method based on time-frequency space graph network according to claim 1 is characterized in that: In S2, the time domain features of the multivariate time series data are extracted by a multi-scale time series feature extractor, specifically: (4)； (5)； In formulas (4) and (5): Represents the extracted multivariate time series data Time domain characteristics; represents a one-dimensional convolution operation; b is the batch size; T is the length of the time series; N is the number of sensors; Representing time domain features Dimensions; For the Layer convolution and different convolution kernels Size, when When filling for: (6)； when When filling for: (7)； The frequency domain characteristics of multivariate time series data are obtained through Fourier transform, specifically: (8)； In formula (8): 、 Represent the real part characteristics of the corresponding amplitude and the imaginary part characteristics of the corresponding phase, The dimension representing the real part feature; The dimension representing the imaginary part feature; The time domain features and frequency domain features are spliced ​​together to obtain node features with time series features: (9)； In formula (9): Represents node features with temporal features; Represents a splicing operation; Represents the final time series feature node dimension.

4. The multivariate time series data anomaly detection method based on time-frequency space graph network according to claim 3 is characterized in that: In S2, time position coding is introduced into the node features, and the coded node features are divided into several time segments, specifically including: Add a time position code to each node feature , where T represents the length of the time series and d represents the feature dimension, which is expanded to , and the final encoding With node features Concatenate on the feature dimension: (10)； In formula (10): Represents the node features after adding time position coding; Node features after adding time position encoding Perform patching operations: (11)； In formula (11): represents the lth time segment, represents the number of time segments, p represents the size of each time segment, and s represents the step size of the time segment.

5. The multivariate time series data anomaly detection method based on time-frequency-space graph network according to claim 4 is characterized in that: In S2, for each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and the symmetry weight, specifically including: The input features are projected into a low-rank space through the query and key mapping: (12)； (13)； In formulas (12) and (13): for The elements in and For nonlinear mapping, the output ,in represents the input feature batch size, is a low-rank dimension; Query-based and key , compute the symmetric and antisymmetric adjacency matrix components: (14)； (15)； In formulas (14) and (15): is a symmetric adjacency matrix component; is the antisymmetric adjacency matrix component; is the transpose of the matrix; The initial adjacency matrix By symmetry weight Fusion yields: (16)； (17)； In formulas (16) and (17): is the sigmoid function; is a learnable symmetric weight parameter, through Map to the (0, 1) interval and generate a weight value; For the initial adjacency matrix Any sub-block in , and the time step of the corresponding row is , the time step of the column is ; Mask matrix Defined as: (18)； The initial adjacency matrix Multiply element-by-element with the mask matrix M to obtain the intermediate adjacency matrix with time constraints : (19)； In formula (19): Indicates time Sensors at and time Sensors at The connection strength between represents the sensor index in the multivariate time series, and N is the total number of sensors; represents the time step index within the time segment in the time series, and p is the size of the time segment; The intermediate adjacency matrix is ​​sparsely processed to obtain the target adjacency matrix: (20)； (21)； In formulas (20) and (21): Indicates time Sensors at and time Sensors at A binary mask indicating whether to retain the connection. A value of 1 indicates retention and a value of 0 indicates discarding. represents the sparse threshold; represents the target adjacency matrix.

6. The multivariate time series data anomaly detection method based on time-frequency space graph network according to claim 2 is characterized in that: In S3, during the training phase of the time-frequency space-time graph network model, the mean absolute error L1 Loss is used as the target loss function: (22)； In formula (22): b is the batch size; is the index of the sample in the batch; For samples True value; For samples Predicted value.

7. The multivariate time series data anomaly detection method based on time-frequency-space graph network according to claim 6 is characterized in that: In S3, during the testing phase of the time-frequency-space graph network model, for each single variable in the multivariate time series , calculate its absolute prediction error at the current timestamp T , and then perform robust normalization: (23)； In formula (23): represents the standardized absolute prediction error; represents the median of the error values; Indicates the interquartile range of the error value; For each single variable After normalization, the multivariate normalized error vector of the current timestamp T is obtained , and accordingly obtain the anomaly score AS of each test sample at the current timestamp T; The obtained anomaly score AS is compared with the set threshold. If it is greater than the set threshold, the corresponding test sample is considered abnormal and the anomaly detection result is output.

8. A device for implementing a multivariate time series data anomaly detection method based on a time-frequency space graph network, characterized in that: The device comprises: The dataset construction module is used to preprocess the multivariate time series data acquired by the sensor to construct the dataset; The multivariate time series data includes normal data and data under attack scenarios, and the data set includes a training set and a validation set constructed based on the normal data, and a test set constructed based on the data under attack scenarios; A model construction module is used to construct a time-frequency-space graph network model. The time-frequency-space graph network model includes a time series feature extraction module and a graph structure learning module. The time series feature extraction module is used to obtain node features with time series features, including: Extract time domain features of multivariate time series data through a multi-scale time series feature extractor; Obtain frequency domain features of multivariate time series data through Fourier transform; The time domain features and frequency domain features are concatenated to obtain node features with time series features; The graph structure learning module is used to model the spatiotemporal dependencies between node features, including: Introducing time position coding into the node features, and dividing the encoded node features into several time segments; For each time segment, the initial adjacency matrix is ​​calculated by combining the attention mechanism and symmetry weights; Introducing a time causal mask into the initial adjacency matrix to obtain an intermediate adjacency matrix with time constraints; performing sparsification on the intermediate adjacency matrix to obtain a target adjacency matrix; Utilize message passing neural networks to propagate and update node features in the target adjacency matrix; A model training module is used to train the constructed time-frequency space-graph network model using the training set, and calculate the anomaly score of the trained time-frequency space-graph network model on the test set, and compare it with the set threshold to detect whether the data is abnormal; Wherein, a threshold is set according to the anomaly score of the trained time-frequency space-graph network model on the validation set.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and A memory storing instructions, which, when executed by the at least one processor, causes the at least one processor to execute the multivariate time series data anomaly detection method based on a time-frequency-space graph network as described in any one of claims 1 to 7.

10. A machine-readable storage medium, characterized in that The machine-readable storage medium stores executable instructions, which, when executed, enable the machine to execute the multivariate time series data anomaly detection method based on a time-frequency-space graph network according to any one of claims 1 to 7.

Images