Multivariate time series data anomaly root cause identification method based on spatiotemporal causal graph

Abstract

The application relates to a kind of multivariate time series data abnormal root cause identification methods based on space-time causal diagram, belong to abnormal detection technical field.The method, to multivariate time series data, uses multi-window expansion causal convolution, combines mutual information screening, extracts time embedding covering short-term mutation and long-time dependence simultaneously;Non-local spatial correlation is learned using multi-head self-attention, then the directional causal strength is measured by conditional entropy, and a sparse, interpretable space-time causal diagram is generated by normalization-pruning;Causal reinforcement graph attention network is introduced on the space-time causal diagram, and the node embedding is updated by multiple rounds of causal propagation;The root cause score is calculated by combining the abnormal degree and the causal influence, the key source node in the abnormal propagation path is identified, and the precise root cause positioning of system anomaly is realized.The application enhances the adaptability to dynamic behavior patterns and the ability to capture abnormal driving factors, and improves the modeling accuracy and root cause identification ability of the abnormal propagation process.

Description

Technical Field

[0001] This invention belongs to the field of anomaly detection technology, specifically relating to a method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs. Background Technology

[0002] With the widespread deployment of the Industrial Internet, key sectors such as manufacturing, energy, power, and transportation are gradually realizing intelligent equipment and interconnected systems. A large number of sensors and edge devices are constantly generating high-frequency, continuous, multi-dimensional time-series data. This data reflects the state changes during system operation and is the foundation for achieving intelligent sensing, anomaly early warning, and predictive maintenance.

[0003] However, achieving effective anomaly detection in the Industrial Internet environment faces numerous challenges. First, data sources are highly diverse and heterogeneous; data collected by different types of sensors differ significantly in dimensionality, units, and sampling frequencies, increasing the difficulty of data fusion and unified modeling. Second, industrial time-series data typically possess multi-scale characteristics and strong spatiotemporal dependencies, making it difficult for simple time-series modeling methods to capture the complex interaction patterns and potential dependency structures between variables.

[0004] More importantly, anomalies in industrial systems often manifest not only as localized, sudden shifts in characteristics, but may also possess deep-seated causal propagation mechanisms. This means that some anomalies are the result of other faults, rather than the root cause itself. If the true "root cause variable" triggering system anomalies cannot be identified, responding only to surface-level anomalies may lead to misjudgments or even systemic risks. Therefore, achieving accurate identification and location of the root cause of anomalies has become one of the core technologies for ensuring the stable operation of industrial systems and rapid fault response.

[0005] Traditional anomaly detection methods often rely on statistical feature extraction or univariate modeling, lacking the ability to model causal relationships between multi-source information. They struggle to handle high-dimensional, dynamic, multi-scale, and strongly coupled data structures, and cannot explain the mechanisms underlying anomaly generation. Therefore, there is an urgent need for a modeling method that integrates time-driven features and spatial structural dependencies, and fuses causal relationships between variables, to construct a spatiotemporal causal graph from a global perspective, achieving high accuracy in anomaly detection and high interpretability in root cause localization. Summary of the Invention

[0006] The purpose of this invention is to improve the accuracy and interpretability of anomaly detection in multivariate time-series data in the industrial internet environment, and to provide a method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs.

[0007] To achieve the above objectives, the technical solution of the present invention is: a method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs, comprising:

[0008] S1. Multi-scale temporal feature extraction based on dilated convolution and mutual information filtering: Features are extracted in parallel from multivariate time series data through causal convolution channels with different dilation rates. The conditional mutual information between the output of each causal convolution channel and the target variable is calculated. The causal convolution channels are weighted to obtain multi-scale temporal embedding with the maximum information content and the minimum redundancy.

[0009] S2. Based on spatial association learning and spatiotemporal causal graph construction: Based on the multi-head self-attention mechanism, a spatial dependency learning structure is constructed to learn the spatial association structure between potential non-local variables; at the same time, conditional entropy is introduced as a causal strength metric to model the temporal directional causal relationship between variables and construct a sparse spatiotemporal causal graph.

[0010] S3. Anomaly detection and root cause localization in spatiotemporal causal graphs: Construct a causal augmented graph neural network, and propagate the temporal embedding features and causal edge weights of nodes simultaneously on the sparse spatiotemporal causal graph. Characterize the importance of nodes from two dimensions: their own anomaly and external influence. By constructing anomaly scoring functions and root cause scoring functions, the system can identify abnormal nodes and locate root cause variables.

[0011] Furthermore, step S1 is implemented as follows:

[0012] Assume there are N sensor nodes, i.e., N time-series variables, and use the index i∈{1,2,…,N} to represent any variable; let... There are 3 parallel causal convolutional channels, each with a different dilation rate d. l Used to perceive time dependence within different ranges:

[0013]

[0014] in, For the i-th variable in the i-th... Each causal convolutional channel, time step The characteristic output, This is the causal convolution channel index, used to distinguish convolution outputs with different dilation rates or receptive fields, with a value range of [value missing]. =1,2,…, w r Let x represent the r-th weight parameter of the convolution kernel. i,t Let k represent the input value of the i-th variable at time t, and k be the kernel size. The outputs of all causal convolution channels are concatenated to obtain the multi-scale temporal embedding feature of the i-th variable.

[0015]

[0016] in, H is represented as the feature sequence of the i-th variable on the l-th causal convolution channel; i This represents the multi-scale temporal representation of the i-th variable; to avoid redundant feature inflation, conditional mutual information is introduced to measure the effect of each causal convolutional channel on the target variable. The contribution of the conditional mutual information score of the l-th causal convolution channel is defined as follows:

[0017]

[0018] Where S represents the currently selected subset of feature channels, used for conditional mutual information calculation of the target variable. ; Indicates assessment Given S, then... Additional contributions; (·) is a learnable function used to calculate the importance score of causal convolution channels; This represents a neural network parameterized by parameter ψ; It represents e. Output power of the product distributed at the margin The expected value below constitutes a learnable lower bound for mutual information; by adjusting the neural network... The parameters are used to maximize and thus approximate the true mutual information score; the conditional mutual information score is used to... Based on this, the outputs of each causal convolutional channel are weighted and fused, and the channel importance coefficients are normalized using the Softmax function. The calculation formula is as follows:

[0019]

[0020] in, For the first Normalized weights for each causal convolutional channel; concatenating the fusion results of all variables to obtain the overall multi-scale temporal embedding matrix: ] ,in, It is a two-dimensional matrix, where T is the time step and D is the dimension of the fused features.

[0021] Furthermore, step S2 is implemented as follows:

[0022] S2.1 Spatial Dependency Learning: Utilizing a self-attention mechanism, learn and quantify the potential spatial dependencies between N sensor nodes or temporal variables; input the overall fusion multi-scale temporal embedding matrix. ] For variables or sensor nodes Extract sensor nodes The feature vector at the last time step T is used as its current state representation:

[0023]

[0024] Construct the vector of query Q, key K, and value V in the self-attention mechanism: in, Let d be a learnable linear mapping matrix, and d′ be the dimension of the attention space; the spatial attention weights of the attention of source variable j to target variable i are:

[0025]

[0026] By aggregating the spatial attention weights among all variables, a spatial correlation strength matrix is ​​constructed:

[0027]

[0028] Calculate spatial context features based on the attention weighting method:

[0029]

[0030] Introducing a multi-head attention mechanism, with a total of M heads, the outputs of each head are concatenated and projected to obtain the final representation:

[0031]

[0032] in, The output projection matrix is ​​used to integrate the attention information from each head and generate a node representation with a unified dimension.

[0033] S2.2 Causal Strength Graph Construction and Sparsification: Causal entropy is introduced to measure the potential causal relationship between variables. Causal entropy is used to assess the degree of reduction in uncertainty caused by variable i to the future state of variable j. Based on the nodal time-space fusion representation, conditional entropy is used to calculate the directional causal influence of variable i on variable j, defined as follows:

[0034]

[0035] in, These are the specific values ​​of variables i and j, and the conditional entropy. The smaller the value, the stronger the causal influence of i on j; construct a normalized causal strength index: To improve the interpretability and sparsity of the causal graph structure, a threshold is introduced. By selecting edge weights, an adjacency matrix for a sparse spatiotemporal causal graph is constructed. :

[0036]

[0037] Among them, when If the threshold τ is exceeded, retain and assign weight; otherwise, set to zero.

[0038] Furthermore, in step S3, the causal augmentation graph neural network is a causal augmentation graph neural network that incorporates both anomaly-causal attention.

[0039] Furthermore, causal augmented graph neural networks propagate the temporal embedding features of nodes and causal edge weights simultaneously, taking into account both the anomalies of nodes themselves and the causal relationships of edges within an information flow. The node update formula for the layer is:

[0040]

[0041] in, This represents the updated feature embedding; Indicates the first Feature embedding of sensor nodes in the layer; , which are neighbors with causal edges; It is an anomalous prior from the previous round; It is an attention coefficient based on sparse causal edge weights; Let u be the parameter matrix of the u-th layer. (·) is a non-linear activation function.

[0042] Furthermore, on the sparse spatiotemporal causal graph, the temporal embedding features of sensor nodes are simultaneously propagated along with the causal edge weights to obtain the final feature embedding representation of sensor node i. .

[0043] Furthermore, in step S3, the anomaly scoring function is constructed as follows:

[0044] Define the anomaly score for sensor node i This is used to measure the anomaly degree of sensor node i in the global causal graph, using reconstruction error or embedding perturbation sensitivity as indicators. The anomaly scoring function is defined as follows:

[0045]

[0046] in, This represents the average embedding of all sensor nodes, used to measure the degree of deviation of sensor node i from the normal distribution center in the embedding space. The final feature embedding representation of sensor node p is represented; a causal driving force index is introduced, utilizing the normalized edge weights of the sparse spatiotemporal causal graph. metric node Cumulative causal output strength for external nodes .

[0047] Furthermore, in step S3, the root cause scoring function is expressed as:

[0048]

[0049] in, Assuming causal output strength, the root cause scoring function has the following interpretability: [Based on...] Sort the nodes from largest to smallest and take the top K nodes as the key root causes that trigger system anomalies. If a node deviates significantly from the normal embedding center and has significant causal output to other nodes, it is judged as the direct root cause of the system anomaly. If a node has an abnormal embedding but lacks an effective output path, it is regarded as a local anomaly point or a propagation termination point. If a node has causal output but its own embedding is not obviously abnormal, it is regarded as a relay propagation node or a non-root cause point.

[0050] The present invention also provides a computer-readable storage medium having stored thereon computer program instructions that can be executed by a processor, wherein when the processor executes the computer program instructions, it can implement the steps of any of the methods described above.

[0051] The present invention also provides an electronic device including a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any of the methods described above.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] 1. This invention introduces a multi-scale dilated causal convolution structure to model multivariate time series data at different time granularities, effectively integrating multiple types of time features such as short-term mutations, periodic fluctuations, and long-term dependencies, thereby enhancing the model's adaptability to dynamic behavior patterns and its ability to capture abnormal driving factors.

[0054] 2. This invention constructs a structured spatiotemporal causal graph model based on spatial attention mechanism and causal entropy measurement, which uniformly represents the spatial dependencies and causal driving paths between variables, thereby improving the modeling accuracy and root cause identification capability of the anomaly propagation process. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the overall process of an embodiment of the present invention.

[0056] Figure 2 This is a schematic diagram illustrating the spatial correlation learning and spatiotemporal causal graph construction of multivariate time-series data according to the present invention.

[0057] Figure 3 This is a schematic diagram of anomaly detection and root cause localization using the spatiotemporal causal graph of the present invention. Detailed Implementation

[0058] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0059] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0060] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0061] This invention provides a method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs, aiming to improve the accuracy and interpretability of anomaly detection in multivariate time-series data in industrial internet environments. First, for multivariate time-series data, multi-window dilated causal convolution is employed, combined with mutual information filtering, to extract temporal embeddings that simultaneously cover short-term mutations and long-term dependencies. Second, multi-head self-attention is used to learn non-local spatial associations, and conditional entropy is used to measure directional causal strength. A sparse, interpretable spatiotemporal causal graph is then generated through normalization and pruning. Finally, a causal enhancement graph attention network is introduced onto the spatiotemporal causal graph to update node embeddings through multiple rounds of causal propagation. A root cause score is calculated by comprehensively considering the degree of anomaly and causal influence, identifying key source nodes in the anomaly propagation path and achieving accurate root cause localization of system anomalies.

[0062] The following is a detailed implementation process of the present invention.

[0063] like Figure 1 As shown, the present invention provides a method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs, comprising the following steps:

[0064] S1. Multi-scale temporal feature extraction based on dilated convolution and mutual information filtering: Features are extracted in parallel from multivariate time series data through causal convolution channels with different dilation rates. The conditional mutual information between the output of each causal convolution channel and the target variable is calculated. The causal convolution channels are weighted to obtain multi-scale temporal embedding with the maximum information content and the minimum redundancy.

[0065] The dilated causal convolution structure guarantees the causality of the convolution operation, meaning that the output at each time step depends only on the current time and its historical time points. Assuming there are N sensor nodes, i.e., N time-series variables, using... This indicates the number of sensors or the number of feature dimensions, and is denoted as follows: There are 3 parallel causal convolutional channels, each with a different dilation rate d. l Used to perceive time dependence within different ranges:

[0066]

[0067] in, For the i-th variable in the i-th... Each causal convolutional channel, time step The characteristic output, This is the causal convolution channel index, used to distinguish convolution outputs with different dilation rates or receptive fields, with a value range of [value missing]. =1,2,…, w r Let x represent the r-th weight parameter of the convolution kernel. i,t Let k represent the input value of the i-th variable at time t, and k be the kernel size. The outputs of all causal convolution channels are concatenated to obtain the multi-scale temporal embedding feature of the i-th variable.

[0068]

[0069] in, H is represented as the feature sequence of the i-th variable on the l-th causal convolution channel; i This represents the multi-scale temporal representation of the i-th variable; to avoid redundant feature inflation, conditional mutual information is introduced to measure the effect of each causal convolutional channel on the target variable. The contribution of the conditional mutual information score of the l-th causal convolution channel is defined as follows:

[0070]

[0071] Where S represents the currently selected subset of feature channels, used for conditional mutual information calculation of the target variable. ; Indicates assessment Given S, then... Additional contributions; (·) is a learnable function used to calculate the importance score of causal convolution channels; This represents a neural network parameterized by parameter ψ; It represents e. Output power of the product distributed at the margin The expected value below constitutes a learnable lower bound for mutual information; by adjusting the neural network... The parameters are used to maximize and thus approximate the true mutual information score; the conditional mutual information score is used to... Based on this, the outputs of each causal convolutional channel are weighted and fused, and the channel importance coefficients are normalized using the Softmax function. The calculation formula is as follows:

[0072]

[0073] in, For the first Normalized weights for each causal convolutional channel; concatenating the fusion results of all variables to obtain the overall multi-scale temporal embedding matrix: ] ,in, It is a two-dimensional matrix, where T is the time step and D is the dimension of the fused features.

[0074] S2, Based on spatial association learning and spatiotemporal causal graph construction (see...) Figure 2 Based on the multi-head self-attention mechanism, a spatially dependent learning structure is constructed to learn the spatial correlation structure between potential non-local variables. At the same time, conditional entropy is introduced as a causal strength metric to model the temporal directional causal relationship between variables and construct a sparse spatiotemporal causal graph.

[0075] S2.1 Spatial Dependency Learning: Utilizing a self-attention mechanism, learn and quantify the potential spatial dependencies between N sensor nodes or temporal variables; input the overall fusion multi-scale temporal embedding matrix. ] For variables or sensor nodes Extract sensor nodes The feature vector at the last time step T is used as its current state representation:

[0076]

[0077] Construct the vector of query Q, key K, and value V in the self-attention mechanism: in, Let d be a learnable linear mapping matrix, and d′ be the dimension of the attention space; the spatial attention weights of the attention of source variable j to target variable i are:

[0078]

[0079] By aggregating the spatial attention weights among all variables, a spatial correlation strength matrix is ​​constructed:

[0080]

[0081] Calculate spatial context features based on the attention weighting method:

[0082]

[0083] Introducing a multi-head attention mechanism, with a total of M heads, the outputs of each head are concatenated and projected to obtain the final representation:

[0084]

[0085] in, The output projection matrix is ​​used to integrate the attention information from each head and generate a node representation with a unified dimension.

[0086] S2.2 Causal Strength Graph Construction and Sparsification: Causal entropy is introduced to measure the potential causal relationship between variables. Causal entropy is used to assess the degree of reduction in uncertainty caused by variable i to the future state of variable j. Based on the nodal time-space fusion representation, conditional entropy is used to calculate the directional causal influence of variable i on variable j, defined as follows:

[0087]

[0088] in, These are the specific values ​​of variables i and j, and the conditional entropy. The smaller the value, the stronger the causal influence of i on j; construct a normalized causal strength index: To improve the interpretability and sparsity of the causal graph structure, a threshold is introduced. By selecting edge weights, an adjacency matrix for a sparse spatiotemporal causal graph is constructed. :

[0089]

[0090] Among them, when If the threshold τ is exceeded, the value is retained and weighted; otherwise, it is set to zero. This suppresses noise edges and provides a structural basis for subsequent anomaly detection and root cause localization.

[0091] S3. Anomaly detection and root cause localization in spatiotemporal causal graphs (see...) Figure 3 ): Construct a causal augmented graph neural network, and propagate the temporal embedding features and causal edge weights of nodes simultaneously on a sparse spatiotemporal causal graph. Characterize the importance of nodes from two dimensions: their own anomalies and external influences. By constructing anomaly scoring functions and root cause scoring functions, the system can identify abnormal nodes and locate root cause variables.

[0092] A causal graph attention network is constructed to learn representations for sparse spatiotemporal causal graphs. Causal-GAT, a dual attention mechanism of anomaly and causality, is introduced to simultaneously propagate the temporal embedding features of nodes and causal edge weights. This approach balances the anomalies of nodes with the causal relationships of edges within a single information flow. The feature embedding update formula for the sensor nodes in the layer is:

[0093]

[0094] in, This represents the updated feature embedding; Indicates the first Feature embedding of sensor nodes in the layer; , which are neighbors with causal edges; It is an anomalous prior from the previous round; It is an attention coefficient based on sparse causal edge weights; Let u be the parameter matrix of the u-th layer. (·) is a non-linear activation function. This dual attention mechanism simultaneously amplifies the anomaly information of a node itself and its causal dependencies with other nodes during feature propagation.

[0095] Spacetime Causal Graph After the graph neural network propagation is completed, the final embedding representation of node i is obtained. By constructing anomaly scoring functions and root cause scoring functions, we can identify outliers and locate root cause variables in a multivariate time series system.

[0096] The principle of causality: The root cause node should have a significant causal output influence on other nodes;

[0097] Anomaly principle: Root cause nodes should be significantly different from normal states in the embedding space;

[0098] Define the anomaly score for node i This is used to measure the anomaly degree of node i in the global causal graph, using reconstruction error or embedding perturbation sensitivity as indicators. The anomaly scoring function is defined as follows:

[0099]

[0100] in, This represents the average embedding of all sensor nodes, used to measure the degree of deviation of sensor node i from the normal distribution center in the embedding space. The final feature embedding representation of sensor node p is represented; a causal driving force index is introduced, utilizing the normalized edge weights of the sparse spatiotemporal causal graph. metric node Cumulative causal output strength for external nodes .

[0101] Root cause scoring function representation:

[0102]

[0103] in, Assuming causal output strength, the root cause scoring function has the following interpretability: [Based on...] Sort the nodes from largest to smallest and take the top K nodes as the key root causes that trigger system anomalies. If a node is significantly deviated from the normal embedding center (i.e., the degree of anomaly is large) and has significant causal output to other nodes (i.e., the driving ability is strong), then it is judged as the direct root cause of the system anomaly. If a node has an abnormal embedding but lacks an effective output path, it is regarded as a local anomaly point or a propagation termination point. If a node has causal output but its own embedding is not obviously abnormal, it is regarded as a relay propagation node or a non-root cause point.

[0104] The present invention also provides a computer-readable storage medium having stored thereon computer program instructions that can be executed by a processor, wherein when the processor executes the computer program instructions, it can implement the steps of any of the methods described above.

[0105] The present invention also provides an electronic device including a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any of the methods described above.

[0106] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0108] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0110] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs, characterized in that, include: S1. Multi-scale temporal feature extraction based on dilated convolution and mutual information filtering: Features are extracted in parallel from multivariate time-series data through causal convolution channels with different dilation rates. The conditional mutual information between the output of each causal convolution channel and the target variable is calculated. The causal convolution channels are weighted to obtain a multi-scale temporal embedding with the maximum information content and the minimum redundancy. Assuming there are N sensor nodes, i.e., N time-series variables, the index i∈{1,2,…,N} is used to represent any variable. S2. Spatial Relationship Learning and Spatiotemporal Causal Graph Construction: A spatial dependency learning structure is constructed based on a multi-head self-attention mechanism to learn the potential spatial relationship structure between non-local variables. Simultaneously, conditional entropy is introduced as a causal strength metric to model the temporal directional causal relationship between variables, constructing a sparse spatiotemporal causal graph. Specifically, causal entropy is introduced to measure the potential causal relationship between variables. Causal entropy is used to assess the degree of uncertainty reduction caused by variable i on the future state of variable j. Based on the node temporal-spatial fusion representation, conditional entropy is used to calculate the directional causal influence of variable i on variable j, defined as follows: in, These are the specific values ​​of variables i and j, and the conditional entropy. The smaller the value, the stronger the causal influence of i on j; construct a normalized causal strength index: To improve the interpretability and sparsity of the causal graph structure, a threshold is introduced. By selecting edge weights, an adjacency matrix for a sparse spatiotemporal causal graph is constructed. : Among them, when If the value exceeds the threshold τ, retain it and assign a weight; otherwise, set it to zero. S3. Anomaly Detection and Root Cause Localization in Spatiotemporal Causal Graphs: A causal augmented graph neural network is constructed. On a sparse spatiotemporal causal graph, the temporal embedding features and causal edge weights of sensor nodes are simultaneously propagated. The importance of nodes is characterized from two dimensions: their own anomaly and their external influence. Anomaly scoring functions and root cause scoring functions are constructed to achieve the identification of abnormal sensor nodes and the localization of root cause variables. Specifically, on a sparse spatiotemporal causal graph, the temporal embedding features and causal edge weights of sensor nodes are simultaneously propagated to obtain the final feature embedding representation of sensor node i. ; The anomaly scoring function is constructed as follows: Define the anomaly score for sensor node i This is used to measure the anomaly degree of sensor node i in the global causal graph, using reconstruction error or embedding perturbation sensitivity as indicators. The anomaly scoring function is defined as follows: in, This represents the average embedding of all sensor nodes, used to measure the degree of deviation of sensor node i from the normal distribution center in the embedding space. The final feature embedding representation of sensor node i is represented; a causal driving force index is introduced, utilizing the normalized edge weights of the sparse spatiotemporal causal graph. metric node Cumulative causal output strength for external nodes ; Root cause scoring function representation: in, Assuming causal output strength, the root cause scoring function has the following interpretability: [Based on...] Sort the nodes from largest to smallest and select the top K nodes as the key root causes that trigger system anomalies.

2. The method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs according to claim 1, characterized in that, Step S1 is implemented as follows: It has There are 3 parallel causal convolutional channels, each with a different dilation rate d. l Used to perceive time dependence within different ranges: in, For the i-th variable in the i-th... Each causal convolutional channel, time step The characteristic output, This is the causal convolution channel index, used to distinguish convolution outputs with different dilation rates or receptive fields, with a value range of [value missing]. =1,2,…, w r Let x represent the r-th weight parameter of the convolution kernel. i,t Let k represent the input value of the i-th variable at time t, and k be the kernel size. The outputs of all causal convolution channels are concatenated to obtain the multi-scale temporal embedding feature of the i-th variable. in, H is represented as the feature sequence of the i-th variable on the l-th causal convolution channel; i This represents the multi-scale temporal representation of the i-th variable; to avoid redundant feature inflation, conditional mutual information is introduced to measure the effect of each causal convolutional channel on the target variable. The contribution of the conditional mutual information score of the l-th causal convolution channel is defined as follows: Where S represents the currently selected subset of feature channels, used for conditional mutual information calculation of the target variable. ; Indicates assessment Given S, then... Additional contributions; (·) is a learnable function used to calculate the importance score of causal convolution channels; This represents a neural network parameterized by parameter ψ; It represents e. Output power of the product distributed at the margin The expected value below constitutes a learnable lower bound for mutual information; by adjusting the neural network... The parameters are used to maximize and thus approximate the true mutual information score; the conditional mutual information score is used to... Based on this, the outputs of each causal convolutional channel are weighted and fused, and the channel importance coefficients are normalized using the Softmax function. The calculation formula is as follows: in, For the first Normalized weights for each causal convolutional channel; concatenating the fusion results of all variables to obtain the overall multi-scale temporal embedding matrix: ] ,in, It is a two-dimensional matrix, where T is the time step and D is the dimension of the fused features.

3. The method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs according to claim 2, characterized in that, In step S2, a spatial dependency learning structure is constructed based on a multi-head self-attention mechanism. The method for learning the potential spatial correlation structure between non-local variables is as follows: using the self-attention mechanism, the potential spatial dependencies between N sensor nodes or temporal variables are learned and quantified; the multi-scale temporal embedding matrix of the overall fusion is input. ] For variables or sensor nodes Extract sensor nodes The feature vector at the last time step T is used as its current state representation: Construct the vector of query Q, key K, and value V in the self-attention mechanism: in, Let d be a learnable linear mapping matrix, and d′ be the dimension of the attention space; the spatial attention weights of the attention of source variable j to target variable i are: By aggregating the spatial attention weights among all variables, a spatial correlation strength matrix is ​​constructed: Calculate spatial context features based on the attention weighting method: Introducing a multi-head attention mechanism, with a total of M heads, the outputs of each head are concatenated and projected to obtain the final representation: in, The output projection matrix is ​​used to integrate the attention information from each head and generate a node representation with a unified dimension.

4. The method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs according to claim 1, characterized in that, In step S3, the causal augmentation graph neural network is a causal augmentation graph neural network that introduces anomaly-causal dual attention.

5. The method for identifying the root causes of anomalies in multivariate time-series data based on spatiotemporal causal graphs according to claim 3, characterized in that, Causal augmentation graph neural networks simultaneously propagate the temporal embedding features of sensor nodes and causal edge weights, taking into account both the anomalies of sensor nodes themselves and the causal correlations of edges within a single information flow. The feature embedding update formula for the sensor nodes in the layer is: in, This represents the updated feature embedding; Indicates the first Feature embedding of sensor nodes in the layer; , which are neighbors with causal edges; It is an anomalous prior from the previous round; It is an attention coefficient based on sparse causal edge weights; Let u be the parameter matrix of the u-th layer. (·) is a non-linear activation function.

6. A computer-readable storage medium having stored thereon computer program instructions executable by a processor, wherein when the processor executes the computer program instructions, it is able to implement the steps of the method as described in any one of claims 1-5.

7. An electronic device comprising a processor and a memory, wherein, The memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the method as described in any one of claims 1-5.

Images