MOT anomaly detection method and system based on multi-source heterogeneous data

Abstract

The invention discloses an MOT anomaly detection method and system based on multi-source heterogeneous data, and relates to the technical field of mobile operation terminal anomaly detection, and the method comprises the steps: enabling MOT equipment to report time series data and log data through a distributed cooperation mechanism, carrying out the missing value filling and standardization preprocessing of the time series data, and carrying out the detection of the log data; processing the log data, performing time dimension alignment fusion on the preprocessed time sequence data and the converted event sequence data to form a unified multivariable time sequence, dynamically determining the size of a sliding window based on the meta-feature of the fused time sequence, dividing a data capture time dependency relationship according to the window, and obtaining the time sequence of the sliding window. And inputting the fused data in the window into an anomaly detection model for state judgment. The method improves the precision and efficiency of anomaly detection, has high practical value and popularization potential, can achieve efficient and reliable monitoring and fault positioning in a complex industrial scene, and provides timely and accurate information support for managers.

Description

Technical Field

[0001] This invention relates to the field of mobile terminal anomaly detection technology, specifically to a method and system for MOT anomaly detection based on multi-source heterogeneous data. Background Technology

[0002] Currently, anomaly detection methods applicable to mobile work terminals (MOTs) mainly rely on single-modal data. Typical methods include anomaly detection based on time-series data and anomaly detection based on log data. Among anomaly detection methods based on time-series data, patents such as CN110933031A, WO2022160902A1, and CN114386521B propose to detect anomalies by analyzing dynamic parameters during equipment operation. These methods can capture key parameters that change dynamically during equipment operation. However, because time-series data is relatively singular, it is easily affected by noise, data loss, and other issues. In addition, these methods have difficulty effectively capturing the correlation information between multimodal data, resulting in limited performance in complex industrial scenarios.

[0003] On the other hand, anomaly detection methods for basic log data (such as patents CN112182219A, WO2022047658A1, and CN113312447B) identify anomalies by analyzing information such as system events and error codes. These methods usually rely on manually configured rules and predefined templates, which are adaptable to specific scenarios but have high processing complexity when dealing with unstructured data. In addition, these methods usually ignore key information that may be contained in modal data, such as environmental data and network communication data, thus limiting the comprehensiveness and accuracy of anomaly detection.

[0004] While a few methods (such as patent CN118394597B) attempt to introduce multi-source heterogeneous data for anomaly detection, they mainly rely on call chain data and log data, which are difficult to obtain comprehensively in MOT, thus limiting their practical application. These methods can work effectively in specific scenarios, but due to the lack of collaborative analysis capabilities for multimodal data, they cannot fully reflect the complexity of industrial scenarios. For example, anomalies in MOT may be affected by multiple factors such as equipment status, environmental factors, user operations, and network communication, and single-modal data is insufficient to fully capture these complex anomaly patterns. Summary of the Invention

[0005] In view of the above-mentioned existing problems, the present invention provides a method and system for MOT anomaly detection based on multi-source heterogeneous data, in order to solve the problem that the existing technology is difficult to effectively capture the correlation information between multimodal data, resulting in limited performance in complex industrial scenarios and limiting the comprehensiveness and accuracy of anomaly detection.

[0006] To address the aforementioned technical issues, a MOT anomaly detection method based on multi-source heterogeneous data is proposed, including:

[0007] The MOT devices report time-series data and log data through a distributed collaborative mechanism, and perform missing value imputation and standardization preprocessing on the time-series data; the log data is processed, and the preprocessed time-series data and the transformed event sequence data are aligned and fused along the time dimension to form a unified multivariate time series; the sliding window size is dynamically determined based on the meta-features of the fused time series, the data is divided according to the window to capture time dependencies, and the fused data within the window is input into the anomaly detection model for state determination.

[0008] As a preferred embodiment of the MOT anomaly detection method based on multi-source heterogeneous data described in this invention, the reported time series data and log data include: deploying two or more server MOT devices in the region; non-server MOT devices compress and deduplicate data through a data deduplication synchronization protocol and then transmit it to the server MOT device; and a single server MOT uniformly reports the data to the central server; when the server MOT fails, the reporting is automatically switched to the backup server MOT.

[0009] As a preferred embodiment of the MOT anomaly detection method based on multi-source heterogeneous data described in this invention, the missing value imputation includes: calculating the similarity between the historical data of the current MOT device and the historical data of adjacent MOT devices, selecting the k adjacent MOT devices with the highest similarity, weighted summing the historical data of the current MOT and the historical data of the k adjacent MOT devices, and using the calculation result as the missing value imputation value.

[0010] As a preferred embodiment of the MOT anomaly detection method based on multi-source heterogeneous data described in this invention, the processing of log data includes log deduplication, event extraction, and sequence transformation.

[0011] The log deduplication process includes segmenting the log text by spaces and generating word frequency vectors, calculating the Euclidean distance between all log vectors, and deleting redundant logs with similarity higher than a threshold. Event extraction includes inputting the deduplicated logs into a semantic analysis model and outputting structured event templates. Sequence transformation includes dynamically adjusting the duration of the statistical window based on the event frequency, calculating the weighted frequency of events within the window based on the event importance weight, and generating an event time series.

[0012] As a preferred embodiment of the MOT anomaly detection method based on multi-source heterogeneous data described in this invention, the event importance weight calculation includes: obtaining the frequency benchmark value of the event under historical normal conditions, calculating the absolute deviation ratio between the current frequency of the event and the frequency benchmark value, and the ratio is the event importance weight.

[0013] The formula for calculating the importance weight of an event is as follows:

[0014]

[0015] Where θ represents the importance of the event, TF current For the frequency of the current event, TF normal The frequency of normal events;

[0016] The process of forming a unified multivariate time series includes aligning and splicing n-dimensional time series data with m-dimensional event series data on the time axis to form a unified multivariate time series with dimension m+n.

[0017] As a preferred embodiment of the MOT anomaly detection method based on multi-source heterogeneous data described in this invention, the dynamic determination of the sliding window size includes: extracting the meta-feature set of the fused time series, inputting the meta-feature set into the analysis model, and outputting a recommended sliding window size value.

[0018] The meta-feature set includes time series length, number of variables, time interval, mean, standard deviation, autocorrelation, inter-variable correlation, stationarity, trend, periodicity, kurtosis, skewness, maximum value, minimum value, range, proportion of missing values, proportion of outliers, rate of change, spectral energy, and information entropy.

[0019] As a preferred embodiment of the MOT anomaly detection method based on multi-source heterogeneous data described in this invention, the state determination includes: selecting the Transformer model as the core algorithm, fusing log features with time series data, constructing a unified input containing multiple dimensions of features, inputting it into the Transformer model, improving the standard Transformer model for the fused time series and log event sequence data, setting a cross-entropy loss function to train the anomaly detection model, measuring the difference between the model prediction and the true label, using the dynamic sliding window technique recommended by the large language model to process the time series data, and the Transformer model outputting the time window state;

[0020] The cross-entropy loss formula is expressed as:

[0021]

[0022] Where Loss is the cross-entropy loss, N is the total number of input samples in the current batch, i is the variable index, and y is the cross-entropy loss. i Let i be the true label of the i-th sample. Let be the predicted value for the i-th sample.

[0023] As a preferred embodiment of the MOT anomaly detection system based on multi-source heterogeneous data described in this invention, it is characterized by including a distributed collaborative data reporting module, a multi-mode data preprocessing module, a time-dependent optimization module, and a discharge control module.

[0024] The distributed collaborative data reporting module is used to utilize a short-range communication self-organizing network and switch to cluster mode when the signal is weak. It reduces redundancy by prioritizing the reporting of key data and using deduplication protocols. Data is aggregated by regional servers and reported via dual-machine backup.

[0025] The multi-modal data preprocessing module is used for missing value imputation and standardization based on spatial correlation, log deduplication, generating event templates using a large language model, and performing dynamic window event sequence conversion.

[0026] The time dependency optimization module is used to extract the meta-features of the fused time series, dynamically recommend the sliding window size through a large language model, divide the data into blocks according to the recommended window, and capture the time dependency relationship.

[0027] The discharge control module is used to concatenate time-series data with log event sequences and process data blocks using an improved Transformer model.

[0028] A computer device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of a method for MOT anomaly detection based on multi-source heterogeneous data.

[0029] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a method for detecting MOT anomalies based on multi-source heterogeneous data.

[0030] The beneficial effects of this invention are as follows: The distributed collaborative data reporting mechanism of this invention ensures the real-time transmission of key data through a dynamic self-organizing network and a priority-differentiated reporting strategy, reducing dependence on the network, thereby reducing data loss and redundancy and improving network transmission efficiency; the architecture not only enhances data integrity but also improves the robustness of the system in complex environments; the fusion of time-series data and log data constructs a comprehensive detection model, enabling the system to fully utilize the advantages of different modal data, improving the accuracy and comprehensiveness of anomaly detection, and overcoming the limitation that single modal data cannot fully describe the MOT state; dynamic sliding window optimization, by using a large language model to analyze the meta-features of the input data and recommending an appropriate sliding window size, enhances the model's ability to capture time dependencies and effectively solves the problem that traditional fixed sliding windows cannot adapt to changes in data characteristics. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 The above is a flowchart of an MOT anomaly detection method based on multi-source heterogeneous data, provided as an embodiment of the present invention.

[0033] Figure 2 The present invention provides a system scheme flowchart for an MOT anomaly detection system based on multi-source heterogeneous data, which is an embodiment of the present invention. Detailed Implementation

[0034] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0035] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0036] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it an embodiment that is mutually exclusive, either alone or selectively, with other embodiments.

[0037] This invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of this invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not adhering to the usual scale. Furthermore, the schematic diagrams are merely examples and should not be construed as limiting the scope of protection of this invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0038] Furthermore, in the description of this invention, it should be noted that the terms "upper," "lower," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used solely for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0039] Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" in this invention should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; similarly, they can refer to mechanical connections, electrical connections, or direct connections, or indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0040] Example 1, referring to Figure 1 This is the first embodiment of the present invention, which provides a method for MOT anomaly detection based on multi-source heterogeneous data, including:

[0041] S1: The MOT devices report time series data and log data through a distributed collaborative mechanism, and the time series data is preprocessed by filling missing values ​​and standardizing.

[0042] The reported time-series data and log data include two or more server MOT devices deployed in the area. Non-server MOT devices compress and deduplicate data through a data deduplication synchronization protocol before transmitting it to the server MOT device. The data is then uniformly reported to the central server by a single server MOT. When the server MOT fails, the system automatically switches to the backup server MOT for reporting.

[0043] Terminal device MOT includes two types of data: time-series data and log data. The goal of data collection is to comprehensively monitor the operating status of the equipment, promptly detect potential anomalies, and ensure the stability and reliability of the equipment. The collection of time-series data aims to capture the dynamic changes of key parameters (such as temperature, pressure, and speed) during equipment operation to reflect the real-time status of the equipment. The collection of log data is used to record the equipment's operating behavior, system calls, and error messages, thereby providing detailed background and behavioral patterns of the equipment's operation. By comprehensively collecting and analyzing these two types of data, comprehensive input information is provided for anomaly detection algorithms, improving the accuracy and robustness of anomaly detection, and providing data support for equipment fault early warning and operation and maintenance optimization.

[0044] The missing value imputation includes calculating the similarity between the historical data of the current MOT device and the historical data of neighboring MOT devices, selecting the k neighboring MOT devices with the highest similarity, weighting and summing the historical data of the current MOT device and the historical data of the k neighboring MOT devices, and using the result as the missing value imputation value.

[0045] S2: Process the log data and align and merge the preprocessed time series data with the transformed event series data along the time dimension to form a unified multivariate time series.

[0046] Furthermore, the processing of log data includes log deduplication, event extraction, and sequence transformation;

[0047] The log deduplication process includes segmenting the log text by spaces and generating word frequency vectors, calculating the Euclidean distance between all log vectors, and deleting redundant logs with similarity higher than a threshold. Event extraction includes inputting the deduplicated logs into a semantic analysis model and outputting structured event templates. Sequence transformation includes dynamically adjusting the duration of the statistical window based on the event frequency, calculating the weighted frequency of events within the window based on the event importance weight, and generating an event time series.

[0048] The Euclidean distance formula is expressed as:

[0049]

[0050] Where A and B are the word frequency vectors of the two log entries, a j and b j Let be the elements in the vector, d(A,B) be the Euclidean distance, n be the vector dimension, and j be the variable index.

[0051] In this application embodiment, the calculation of the event importance weight includes obtaining the frequency reference value of the event under historical normal conditions, calculating the ratio of the absolute deviation between the current frequency of the event and the frequency reference value, and the ratio is the event importance weight.

[0052] In one optional implementation, the event importance weight calculation includes dynamically calculating the average event frequency of the most recent M windows (e.g., M=10) as the average frequency under normal conditions, and calculating a standardized value for the current window frequency.

[0053] In another optional implementation, the event importance weight calculation includes predefining event type weights (e.g., error log = 1.5, operation log = 1.0) and calculating the base frequency weight.

[0054] The formula for calculating the importance weight of an event is as follows:

[0055]

[0056] Where θ represents the importance of the event, TF current For the frequency of the current event, TF normal The frequency of normal events;

[0057] Data fusion involves aligning and stitching 21-dimensional time-series data with 5-dimensional event sequence data (a total of 26 dimensions) according to timestamps.

[0058] S3: Dynamically determine the sliding window size based on the meta-features of the fused time series, divide the data according to the window to capture time dependencies, and input the fused data within the window into the anomaly detection model for state determination.

[0059] Furthermore, in this embodiment, determining the sliding window size includes extracting a set of meta-features from the fused time series, inputting the set of meta-features into the analysis model, and outputting a recommended sliding window size value.

[0060] In one optional implementation, determining the sliding window size includes setting a rule base: when the periodicity is greater than 0.8, the window = period length × 2; when the rate of change is greater than the threshold, the window = 5 minutes, the remaining window = 15 minutes, performing rule matching on the meta-features, and taking the output of the highest priority rule as the window value.

[0061] In another optional implementation, determining the sliding window size includes extracting meta-features from historical data to construct feature vectors, using K-means clustering to divide the data into 3 groups (e.g., stationary / periodic / mutant), and presetting the window size for each group (stationary = 30 minutes, mutant = 5 minutes), and assigning matching windows to real-time data after classifying it according to nearest neighbors.

[0062] The meta-feature set includes time series length, number of variables, time interval, mean, standard deviation, autocorrelation, inter-variable correlation, stationarity, trend, periodicity, kurtosis, skewness, maximum value, minimum value, range, proportion of missing values, proportion of outliers, rate of change, spectral energy, and information entropy.

[0063] Furthermore, the state determination includes selecting the Transformer model as the core algorithm, fusing log features with time series data, constructing a unified input containing multiple dimensions of features, inputting it into the Transformer model, improving the standard Transformer model for the fused time series and log event sequence data, setting a cross-entropy loss function to train an anomaly detection model, measuring the difference between the model prediction and the true label, using the dynamic sliding window technique recommended by the large language model to process the time series data, and the Transformer model outputting the time window state;

[0064] The cross-entropy loss formula is expressed as:

[0065]

[0066] Where Loss is the cross-entropy loss, N is the total number of input samples in the current batch, i is the variable index, and y is the cross-entropy loss. i Let i be the true label of the i-th sample. Let be the predicted value for the i-th sample.

[0067] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0068] Example 2, refer to Figure 2 This is the second embodiment of the present invention. This embodiment provides a MOT anomaly detection system based on multi-source heterogeneous data, including a distributed collaborative data reporting module, a multi-mode data preprocessing module, a time-dependent optimization module, and a discharge control module.

[0069] The distributed collaborative data reporting module is used to utilize a short-range communication self-organizing network and switch to cluster mode when the signal is weak. It reduces redundancy by prioritizing the reporting of key data and using deduplication protocols. Data is aggregated by regional servers and reported via dual-machine backup.

[0070] The multi-modal data preprocessing module is used for missing value imputation and standardization based on spatial correlation, log deduplication, generating event templates using a large language model, and performing dynamic window event sequence conversion.

[0071] The time dependency optimization module is used to extract 19 meta-features from the fused time series, dynamically recommend the sliding window size through a large language model, divide the data into blocks according to the recommended window, and capture time dependencies.

[0072] The discharge control module is used to concatenate time-series data with log event sequences and process data blocks using an improved Transformer model.

[0073] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0074] Example 3, the third embodiment of the present invention, differs from the previous two embodiments in that:

[0075] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0076] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0077] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0078] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

Claims

1. A method for MOT anomaly detection based on multi-source heterogeneous data, characterized in that: include, The MOT devices report time-series data and log data through a distributed collaborative mechanism, and perform missing value imputation and standardization preprocessing on the time-series data; The log data is processed, and the preprocessed time series data is aligned and merged with the transformed event series data in terms of time dimension to form a unified multivariate time series. The sliding window size is dynamically determined based on the meta-features of the fused time series, the data is divided according to the window to capture time dependencies, and the fused data within the window is input into the anomaly detection model for state determination.

2. The MOT anomaly detection method based on multi-source heterogeneous data as described in claim 1, characterized in that: The reported time-series data and log data include two or more server MOT devices deployed in the area. Non-server MOT devices compress and deduplicate data through a data deduplication synchronization protocol before transmitting it to the server MOT device. The data is then uniformly reported to the central server by a single server MOT. When the server MOT fails, the system automatically switches to the backup server MOT for reporting.

3. The MOT anomaly detection method based on multi-source heterogeneous data as described in claim 2, characterized in that: The missing value imputation includes calculating the similarity between the historical data of the current MOT device and the historical data of neighboring MOT devices, selecting the k neighboring MOT devices with the highest similarity, weighting and summing the historical data of the current MOT device and the historical data of the k neighboring MOT devices, and using the result as the missing value imputation value.

4. The MOT anomaly detection method based on multi-source heterogeneous data as described in claim 3, characterized in that: The processing of log data includes log deduplication, event extraction, and sequence transformation; The log deduplication process includes segmenting the log text by spaces and generating word frequency vectors, calculating the Euclidean distance between all log vectors, and deleting redundant logs with similarity higher than a threshold. Event extraction involves inputting the deduplicated logs into a semantic analysis model and outputting structured event templates. Sequence transformation involves dynamically adjusting the duration of the statistical window based on the event frequency, calculating the weighted frequency of events within the window based on the event importance weight, and generating an event time series.

5. The MOT anomaly detection method based on multi-source heterogeneous data as described in claim 4, characterized in that: The calculation of the event importance weight includes obtaining the frequency baseline value of the event under historical normal conditions, calculating the ratio of the absolute deviation between the current frequency of the event and the frequency baseline value, and the ratio is the event importance weight. The formula for calculating the importance weight of an event is as follows: Where θ represents the importance of the event, TF current For the frequency of the current event, TF normal The frequency of normal events; The process of forming a unified multivariate time series includes aligning and splicing n-dimensional time series data with m-dimensional event series data on the time axis to form a unified multivariate time series with dimension m+n.

6. The MOT anomaly detection method based on multi-source heterogeneous data as described in claim 5, characterized in that: The dynamic determination of the sliding window size includes extracting the meta-feature set of the fused time series, inputting the meta-feature set into the analysis model, and outputting a recommended sliding window size value. The meta-feature set includes time series length, number of variables, time interval, mean, standard deviation, autocorrelation, inter-variable correlation, stationarity, trend, periodicity, kurtosis, skewness, maximum value, minimum value, range, proportion of missing values, proportion of outliers, rate of change, spectral energy, and information entropy.

7. The MOT anomaly detection method based on multi-source heterogeneous data as described in claim 6, characterized in that: The state determination process includes selecting the Transformer model as the core algorithm, fusing log features with time series data, constructing a unified input containing multiple dimensions of features, inputting it into the Transformer model, improving the standard Transformer model for the fused time series and log event sequence data, setting a cross-entropy loss function to train an anomaly detection model, measuring the difference between the model prediction and the true label, using the dynamic sliding window technique recommended by the large language model to process the time series data, and the Transformer model outputting the time window state. The cross-entropy loss formula is expressed as: Where Loss is the cross-entropy loss, N is the total number of input samples in the current batch, i is the variable index, and y is the cross-entropy loss. i Let i be the true label of the i-th sample. Let be the predicted value for the i-th sample.

8. A system employing the MOT anomaly detection method based on multi-source heterogeneous data as described in any one of claims 1 to 7, characterized in that: It includes a distributed collaborative data reporting module, a multi-mode data preprocessing module, a time-dependent optimization module, and a discharge control module; The distributed collaborative data reporting module is used to utilize a short-range communication self-organizing network and switch to cluster mode when the signal is weak. It reduces redundancy by prioritizing the reporting of key data and using a deduplication protocol. The data is aggregated by the regional server and reported via dual-machine backup. The multi-modal data preprocessing module is used for missing value imputation and standardization based on spatial correlation, log deduplication, generating event templates using a large language model, and performing dynamic window event sequence conversion. The time dependency optimization module is used to extract the meta-features of the fused time series, dynamically recommend the sliding window size through a large language model, divide the data into blocks according to the recommended window, and capture the time dependency relationship. The discharge control module is used to concatenate time-series data with log event sequences and process data blocks using an improved Transformer model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the MOT anomaly detection method based on multi-source heterogeneous data as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the MOT anomaly detection method based on multi-source heterogeneous data as described in any one of claims 1 to 7.

Images