Detection method, device, equipment, medium and product

Abstract

The invention discloses a detection method, device and equipment, a medium and a product. The method comprises the following steps: acquiring monitored data, and performing data conversion on the monitored data to obtain target data; the target data is data obeying normal distribution; and determining an anomaly detection result based on the target data and the control chart. Through the technical scheme of the invention, non-normal data with different original shapes (such as skewness and multiple peaks) can be automatically, intelligently and efficiently converted into a form approximately obeying normal distribution, and finally, the converted data can be directly and reliably input into a classical control chart for anomaly monitoring. The problem of misinformation caused by the fact that the distribution hypothesis is not met in a traditional method is effectively solved, and a key technical support is provided for reducing the engineering operation and maintenance cost.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of data detection, and in particular to a detection method, device, equipment, medium and product. BACKGROUND

[0002] The rapid development and wide application of Internet of Things technology are profoundly changing the energy production and management mode. In the field of new energy such as wind power, photovoltaic and energy storage, this change is particularly significant: wind turbines scattered in wind farms continuously record the power output curve, photovoltaic arrays in a row accurately capture the power generation efficiency of each component, and the battery state of energy storage units and the operating parameters of inverters are also collected in real time. These massive and diversified key operating data are efficiently acquired and intuitively displayed through various advanced Internet of Things devices, greatly improving the digital level of equipment and the transparency of operating state.

[0003] With the continuous operation of equipment and the deepening of data analysis needs, the owner party is no longer satisfied with basic data collection and display. Real-time and accurate monitoring and early warning of core performance indicators (such as power generation, equipment efficiency, and key component state) have become the core demand to ensure asset benefits and optimize operation and maintenance strategies. Therefore, the industry generally uses the classic tool SPC Chart (Statistical Process Control Chart). Control chart originated from the field of industrial quality control and is known for its powerful anomaly detection capability. Its core principle is to set reasonable upper and lower control limits based on historical data, and when a new monitoring point exceeds these limits, an abnormal signal is sent. For example, for the critical daily power generation indicator, once the control chart shows that the daily data point is continuously below the control lower limit, this is a strong early warning signal, indicating that there may be equipment failure (such as blade damage, photovoltaic component shading or efficiency decay, inverter failure, etc.), so as to quickly trigger the operation and maintenance process and send engineers for targeted maintenance, effectively preventing power loss or further damage to equipment.

[0004] However, a key premise of the control chart method is that the monitored data sequence should approximately obey a normal distribution (Gaussian distribution). The calculation of its control limit (usually mean ± 3 times standard deviation) is based on the characteristics of the normal distribution. Unfortunately, in the actual application scenario of new energy Internet of Things, a large amount of collected key operation data often does not strictly conform to this idealized distribution assumption. Wind power generation is significantly affected by wind speed volatility, and its power output often presents a bimodal or skewed distribution; photovoltaic power generation is affected by sunlight intensity, cloud cover, etc., and its distribution pattern may be highly irregular; the charging and discharging data of energy storage systems are also driven by load demand and price strategies, and the distribution is complex. When these non-normal distribution data are directly applied to the classic normal assumption control chart, a serious problem will occur: the false positive rate will increase significantly. Normal fluctuations may be incorrectly identified as abnormal (exceeding the control limit), frequently triggering unnecessary alarms.

[0005] The consequence of this "wolf coming" effect is high engineering operation cost, and the engineering team needs to spend a lot of time and resources to investigate the "faults" that do not actually exist on site, which not only leads to ineffective labor, delays the handling of real faults, but also causes unnecessary equipment downtime inspection (loss of opportunity cost of power generation), and increases direct operation expenses such as travel and labor. Therefore, in the era of big data driven by Internet of Things, in the face of the ubiquitous non-normal data characteristics, simply relying on the classic normal assumption control chart is not enough, and may even be counterproductive. Exploring intelligent monitoring methods that are more suitable for actual data distribution characteristics (such as applying non-parametric control charts, time series analysis models, machine learning anomaly detection algorithms, etc.) has become an urgent need and important research direction to improve monitoring accuracy, reduce operation cost, and ensure efficient operation of new energy assets. SUMMARY

[0006] Embodiments of the present application provide a detection method, device, equipment, medium and product, which can overcome the false positive problem caused by the failure of the distribution assumption of the traditional method, and provide key technical support for reducing engineering operation cost.

[0007] According to an aspect of the present application, a detection method is provided, comprising:

[0008] Obtaining monitored data, and performing data transformation on the monitored data to obtain target data; the target data is data obeying a normal distribution;

[0009] Determining an anomaly detection result based on the target data and a control chart.

[0010] According to another aspect of the present application, a detection device is provided, comprising:

[0011] An acquisition and conversion module is configured to acquire monitored data and perform data conversion on the monitored data to obtain target data, wherein the target data is data subject to normal distribution.

[0012] A determination module is configured to determine an anomaly detection result based on the target data and a control chart.

[0013] According to another aspect of the present application, an electronic device is provided, which comprises:

[0014] at least one processor; and

[0015] a memory connected to the at least one processor in communication; wherein

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the detection method according to any one of the embodiments of the present application.

[0017] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to perform the detection method according to any one of the embodiments of the present application when executed by the processor.

[0018] According to another aspect of the present application, the embodiments of the present application further provide a computer program product, which comprises a computer program, and the computer program, when executed by a processor, implements the detection method according to any one of the embodiments of the present application.

[0019] The embodiments of the present application acquire monitored data and perform data conversion on the monitored data to obtain target data, wherein the target data is data subject to normal distribution, and then determine an anomaly detection result based on the target data and a control chart. Through the technical solution of the present application, non-normal data with various forms (such as skewness and multi-peak) can be automatically and intelligently converted into a form subject to normal distribution, and finally, the data after conversion can be directly and reliably input into a classic control chart for anomaly monitoring, thereby effectively overcoming the false alarm problem caused by the failure of distribution assumption in traditional methods, and providing key technical support for reducing engineering operation and maintenance costs.

[0020] It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0022] Figure 1 is a flow chart of a detection method in an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of a general data conversion method in an embodiment of the present application;

[0024] Figure 3 is a structural schematic diagram of a detection device in an embodiment of the present application;

[0025] Figure 4 is a structural schematic diagram of an electronic device for implementing the detection method of the embodiment of the present application. DETAILED DESCRIPTION

[0026] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and their, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0028] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type of personal information involved in the present disclosure, the scope of use, the use scenario, etc. should be informed to the user and the authorization of the user should be obtained according to relevant laws and regulations.

[0029] Embodiment one

[0030] Figure 1 This is a flowchart of a detection method according to an embodiment of the present invention. This embodiment is applicable to the detection of data anomalies. The method can be executed by the detection device in this embodiment of the present invention, which can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps:

[0031] S101. Obtain the monitored data and perform data transformation on the monitored data to obtain the target data.

[0032] In this embodiment, the monitored data can be, for example, the power output curves continuously recorded by wind turbine generators throughout a wind farm in a real-world application scenario of the new energy Internet of Things; the power generation efficiency of each component precisely captured by a continuous photovoltaic array; and the battery status and inverter operating parameters of energy storage units collected in real time. These are massive and diverse key operational data. In actual operation, wind power generation is significantly affected by wind speed fluctuations, and its power output often exhibits a bimodal or skewed distribution; photovoltaic power generation is affected by factors such as solar radiation intensity and cloud cover, and its distribution may also be highly irregular; the charging and discharging data of energy storage systems are also driven by load demand and electricity pricing strategies, resulting in a complex distribution. Therefore, most of the monitored data mentioned above are non-normally distributed data.

[0033] It should be noted that data transformation can be the process of converting non-normally distributed monitored data into target data that follows a normal distribution.

[0034] The target data is data that follows a normal distribution.

[0035] Specifically, the monitored data is collected, and the non-normally distributed monitored data is transformed to obtain target data that follows a normal distribution.

[0036] S102. Determine the anomaly detection results based on the target data and control chart.

[0037] As we know, SPC (Statistical Process Control) control charts are scientifically designed charts used to measure, record, and control process quality for management purposes. In this embodiment, control charts are primarily used to detect anomalies in target data that follows a normal distribution.

[0038] It should be noted that the anomaly detection result can indicate that the data is abnormal or that no anomaly is found.

[0039] Specifically, the target data can be plotted on a control chart to determine if there are any anomalies in the data.

[0040] The embodiment of the present application obtains monitored data, and performs data transformation on the monitored data to obtain target data, the target data being data subject to normal distribution, and then determines an abnormality detection result based on the target data and a control chart. Through the technical solution of the present application, non-normal data of various forms (such as skewness and multimodal) can be automatically and intelligently transformed into a form subject to normal distribution in a high-efficiency manner. Ultimately, the data after the transformation processing can be directly and reliably input into a classic control chart for abnormality monitoring, effectively overcoming the false alarm problem caused by the failure of the distribution assumption in the traditional method, and providing key technical support for reducing engineering operation and maintenance costs.

[0041] Optionally, the data transformation on the monitored data to obtain the target data comprises:

[0042] The monitored data is input into a data transformation model to obtain the target data.

[0043] In the embodiment, the data transformation model can be a model for transforming non-normal distribution data into data subject to normal distribution. The data transformation model comprises at least one data transformation sub-model, and the data transformation sub-model is composed of a Transformer network and a hybrid loss function.

[0044] Preferably, the embodiment constructs a universal normal conversion model through a probability chain Transformer framework and an adaptive NLL-Shapiro-Wilk hybrid loss function, and automatically transforms non-normal data to meet the normal assumption requirement of the control chart. NLL is the abbreviation of Negative Log-Likelihood, that is, negative log-likelihood. Shapiro-Wilk test is a statistical test method for testing whether data comes from a normal distribution. The closer the test statistic W is to 1, the closer the data is to the normal distribution. The Shapiro-Wilk test statistic can be used to measure the normality of the predicted distribution.

[0045] In the embodiment, a probability chain Transformer network architecture is constructed. This architecture learns and captures the potential distribution characteristics of complex original data through deep probability modeling capability.

[0046] In the embodiment, a weight-adjustable hybrid loss function is also constructed to drive the optimization process of the model. The function combines the negative log-likelihood (NLL) loss (as the core of maximum probability estimation, ensuring that the transformed data fits the target normal distribution to the greatest extent) and the Shapiro-Wilk (SW) test statistic (directly evaluating the degree of fit between the data conversion result and the normal distribution, and converting it into a differentiable loss term to guide the model to optimize towards the normalizing goal).

[0047] As an exemplary description of an embodiment of the present application, Figure 2 is a schematic diagram of a general data transformation method in an embodiment of the present application. As shown, Figure 2 the monitored data is input into a data transformation model to obtain target data. The data transformation model includes at least one data transformation sub-model. Specifically, the data transformation sub-model is composed of a shallow probability Transformer network framework and a hybrid loss function (the hybrid loss equation can be represented as {a1*NLL+b1*SW}…{an*NLL+bn*SW}).

[0048] Optionally, inputting the monitored data into the data transformation model to obtain the target data includes:

[0049] The monitored data is input into the Transformer network to obtain predicted data.

[0050] It should be noted that the predicted data can be data that obeys a normal distribution obtained by predicting the monitored data according to a non-normal distribution.

[0051] In actual operation, let the set of original data (i.e., monitored data) collected by a certain monitoring point be D={x1,x2,…,xN}, where N is the sample size. The goal of this embodiment is to construct a mapping function fθ:D→Z, so that the set of converted data (i.e., target data) Z={z1,z2,…,zN} strictly obeys the standard normal distribution N(0,1), i.e., zi=fθ(xi), Z~N(0,1). This embodiment uses a probabilistic reform Transformer encoder as the core component of the mapping function fθ, and its innovation lies in extending the deterministic output of the standard Transformer to a probability distribution parameter.

[0052] Specifically, the monitored data is input into the Transformer network to learn and capture the latent distribution characteristics of complex original data, and obtain predicted data.

[0053] The predicted data is optimized based on the hybrid loss function to obtain the target data.

[0054] Specifically, the NLL-driven model learns the conversion parameters to make the output predicted data approximate the target normal distribution N(0,1), and the SW statistic is used as a loss term to directly punish the deviation from the normal distribution, ensuring that the converted data passes the normality verification and balancing the distribution fitting and normality requirements.

[0055] Optionally, inputting the monitored data into the Transformer network to obtain the predicted data includes:

[0056] The monitored data is input into a Transformer network, word embedding is performed, and position encoding is added to obtain an embedding vector.

[0057] In the implementation process, the monitored data xi is first input into a learnable embedding layer (the function of the embedding layer is to map each word (or token) in the input sequence to a high-dimensional vector space. Specifically, for the i-th word xi in the input sequence, the embedding layer will project it to a fixed-dimensional vector Embedding(xi) in a high-dimensional space, and add a time position encoding (the function of the position encoding is to add position information to each word, because the Transformer model itself does not depend on the order of the sequence. The position encoding is a fixed vector with the same dimension as the embedding vector, which is used to represent the position of the word in the sequence, PositionalEncoding(i)), to obtain an embedding vector Ei=Embedding(xi)+PositionalEncoding(i). This combination allows the representation of each word to contain both semantic information (through the embedding layer) and position information (through the position encoding). This preserves the sequential dependence of the data and avoids the distortion of traditional statistical methods due to the neglect of the time structure.

[0058] The embedding vector is decomposed into query, key, and value vectors, and a multi-head attention mechanism is used to decompose the query, key, and value into multiple heads, and attention is calculated for each head.

[0059] In the implementation process, the embedding vector Ei (which can be abbreviated as embedding vector E in the following) is decomposed into a query (Query), key (Key), and value (Value) triple: Q=EWQ,K=EWK,V=EWV. Among them, the query vector Q is a vector used to query information, which is obtained by multiplying the embedding vector E with a learnable weight matrix WQ; the key vector K is a vector used to store information, which is obtained by multiplying the embedding vector E with a learnable weight matrix WK; the value vector V is the actual stored information, which is obtained by multiplying the embedding vector E with a learnable weight matrix Wv.

[0060] where (Q, K, V) are trainable weight matrices. The context-aware representation is calculated by scaled dot-product attention: In the formula, dk is the dimension of the key / query vector, and dk is the scaling factor to prevent gradient vanishing.

[0061] In actual operation, the core idea of the self-attention mechanism is to calculate the attention weight through the dot product of the query vector Q and the key vector K, and then perform weighted summation on the value vector V using these weights. The specific steps are as follows:

[0062] Compute attention scores: Attention Scores = QKT, where Q and K have dimensions (n, dk), where n is the sequence length and dk is the dimension of the key vectors.

[0063] Scale the attention scores: This step is to prevent the dot product result from being too large, causing the gradient vanishing problem.

[0064] Apply the Softmax function: Where the Softmax function normalizes the attention scores into a probability distribution.

[0065] Weighted sum: Output = Attention Weights * V, the final output is the weighted sum of attention weights and value vectors.

[0066] After concatenating the attention of all heads, the results are integrated through a linear transformation, and the hidden state is obtained through layer normalization and residual connection.

[0067] In the implementation process, to enhance the model's ability to capture different distribution characteristics, h groups of attention calculations are performed in parallel (referred to as "multi-head"), and the multi-head attention mechanism decomposes Q, K and V into h heads, each of which calculates attention: headi = Attention(QWiQ, KWiK, VWiV), where WiQ, WiK and WiV are the weight matrices of the ith head. Concatenate the results of all heads, then integrate the results through a linear transformation WO: MultiHead(Q, K, V) = Concat(head1, …, headh) WO.

[0068] In actual operation, the outputs of each head are projected through a linear layer WO after concatenation, and layer normalization (Layer Normalization) and residual connection are used to improve training stability: H = LayerNorm(E + MultiHead(Q, K, V)). Where layer normalization normalizes the features of each sample, the specific formula is as follows:

[0069]

[0070] Where μ is the mean of x, σ is the standard deviation of x, and γ and β are learnable parameters for scaling and shifting.

[0071] Map the hidden state to the mean and standard deviation, and determine the predicted data based on the mean and standard deviation.

[0072] In the implementation process, at the end of the Transformer encoder, a probability output layer is designed to generate normal distribution parameters. This layer maps the hidden state H to the mean μ and standard deviation σ through two linear transformations: Taking the logarithm of sigma ensures a positive constraint.

[0073] The final output zi is sampled by a reparameterization trick: zi = μ + σ ⊙ ∈, ∈ ~ N(0, 1) is a standard normal distributed random variable, and ⊙ denotes element-wise multiplication. This design makes zi strictly follow a normal distribution N(μ, σ 2 ) and the whole process is differentiable.

[0074] Optionally, the prediction data is optimized based on a hybrid loss function to obtain target data, including:

[0075] A negative log-likelihood loss is determined according to the prediction data and the monitored data.

[0076] It can be known that the negative log-likelihood loss is a common method for measuring the difference between the model prediction distribution and the real data. For a normal distribution, the NLL loss can be expressed as:

[0077]

[0078] Where y is the true value, μ is the predicted mean, and σ is the predicted standard deviation.

[0079] Specifically, the NLL loss is calculated according to the prediction data and the monitored data.

[0080] The negative value of the test statistic is obtained, and a hybrid loss function is composed of the negative value of the test statistic and the negative log-likelihood loss.

[0081] In this embodiment, SW is the negative value of the Shapiro-Wilk test statistic (since the Shapiro-Wilk test statistic is closer to 1, the negative value is taken as the loss).

[0082] In actual operation, while ensuring the distribution fitting fidelity and normality of the converted data, this embodiment designs a hybrid loss function with adjustable weight:

[0083] LF = aNLL - (1-a)SW;

[0084] Where NLL is the equivalent form of MLE (Maximum Likelihood Estimation). Minimizing NLL is equivalent to maximizing the likelihood function, i.e., finding the parameter θ that makes the observed data have the highest probability. The SW test comes from hypothesis testing: the null hypothesis H0: the data comes from a normal distribution, and the alternative hypothesis H1: the data does not follow a normal distribution. Therefore, the closer the SW value is to 1, the more the data conforms to the normal distribution.

[0085] The prediction data is optimized based on the hybrid loss function to obtain the target data.

[0086] Specifically, the NLL-driven model learns the conversion parameters to make the output data approximate the target normal distribution N(0, 1), and the SW statistic is used as a loss term to directly punish the deviation from the normal distribution, ensuring that the converted data passes the normality test and balances the distribution fitting and normality requirements.

[0087] In actual operation, to improve the conversion capability of complex non-normal distribution, the embodiment further proposes a chain probability Transformer. K probability Transformer units are connected in series, and the output of the previous unit is used as the input of the next unit: Z K = fθ K (Z k-1 ). The final output Z = Z(K) is the normal data after K times of gradual conversion.

[0088] Optionally, the abnormality detection result is determined based on the target data and the control chart, including:

[0089] The mean and standard deviation of the target data are obtained, and the control limit is determined based on the mean and standard deviation of the target data.

[0090] It can be known that the control limit is the upper and lower limits on the control chart, which is used to determine whether the data point is abnormal. Generally, the control limit is calculated based on the mean and standard deviation of the data: upper control limit: μ + kσ; lower control limit: μ - kσ. Wherein, k is a constant, usually taking a value of 3 (corresponding to 99.73% of data points within the control limit).

[0091] Specifically, the mean and standard deviation of the converted target data are calculated, and the control limit (including the upper control limit and the lower control limit) is calculated based on the mean and standard deviation.

[0092] The data points are plotted on the control chart, and the control limit is marked.

[0093] Specifically, the target data is plotted on the control chart to form data points, and the control limit is marked.

[0094] If there is a data point exceeding the control limit, it is determined that the abnormality detection result is that the data is abnormal.

[0095] Specifically, it is observed whether the data point exceeds the control limit: if the data point exceeds the upper control limit or the lower control limit, it is considered that the data point is abnormal; if the data point is within the control limit, but presents a certain pattern (such as continuous rise or fall), it may also indicate that the process is out of control.

[0096] The technical scheme of the embodiment of the present application can automatically and intelligently convert non-normal data of various forms (such as skewness and multi-peak) into a form approximately subject to normal distribution in an efficient manner. Ultimately, the data converted in this way can be directly and reliably input into a classic control chart for abnormality monitoring, effectively overcoming the false alarm problem caused by the failure of the distribution assumption in the traditional method, and providing key technical support for reducing engineering operation and maintenance costs.

[0097] Embodiment two

[0098] Figure 3 is a structural schematic diagram of a detection device in the embodiment of the present application. The embodiment can be applicable to the case of data anomaly detection. The device can be realized in the form of software and / or hardware, and can be integrated into any device that provides the function of detection, such as a computer. Figure 3 As shown in the figure, the detection device specifically comprises an acquisition and conversion module 201 and a determination module 202.

[0099] The acquisition and conversion module 201 is configured to acquire monitored data and perform data conversion on the monitored data to obtain target data; the target data is data subject to normal distribution.

[0100] The determination module 202 is configured to determine an anomaly detection result based on the target data and a control chart.

[0101] Optionally, the acquisition and conversion module 201 comprises:

[0102] An input unit is configured to input the monitored data into a data conversion model to obtain target data; the data conversion model comprises at least one data conversion sub-model, and the data conversion sub-model is composed of a Transformer network and a hybrid loss function.

[0103] Optionally, the input unit comprises:

[0104] An input sub-unit is configured to input the monitored data into the Transformer network to obtain predicted data.

[0105] An optimization sub-unit is configured to optimize the predicted data based on the hybrid loss function to obtain target data.

[0106] Optionally, the input sub-unit is specifically configured to:

[0107] input the monitored data into the Transformer network, perform word embedding operation and add position encoding to obtain an embedding vector;

[0108] decompose the embedding vector into a query, a key and a value, and determine an attention score based on the query, the key and the value.

[0109] The embedding vector is decomposed into three vectors of query, key and value, and a multi-head attention mechanism is used to decompose the query, key and value into multiple heads, and the attention is calculated for each head respectively;

[0110] The attention of all heads is spliced, and the result is integrated through linear transformation, and the hidden state is obtained through layer normalization and residual link;

[0111] The hidden state is mapped to the mean and standard deviation, and the predicted data is determined according to the mean and the standard deviation.

[0112] Optionally, the optimization subunit is specifically used for:

[0113] A negative log-likelihood loss is determined according to the predicted data and the monitored data;

[0114] The negative value of the test statistic is obtained, and a hybrid loss function is composed according to the negative value of the test statistic and the negative log-likelihood loss;

[0115] The predicted data is optimized based on the hybrid loss function to obtain target data.

[0116] Optionally, the determination module 202 is specifically used for:

[0117] The mean and standard deviation of the target data are obtained, and the control limit is determined according to the mean and standard deviation of the target data;

[0118] Data points are plotted on the control chart, and the control limit is marked;

[0119] If there is a data point exceeding the control limit, it is determined that the anomaly detection result is that the data is abnormal.

[0120] The above product can execute the detection method provided by any embodiment of the application, and has the corresponding function modules and beneficial effects of the execution method.

[0121] Embodiment three

[0122] Figure 4 A structural schematic diagram of an electronic device 30 that can be used to implement embodiments of the application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (such as headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the applications described and / or claimed in this document.

[0123] As shown in Figure 4 The electronic device 30 includes at least one processor 31, and a memory, such as a read-only memory (ROM) 32, a random access memory (RAM) 33, etc., connected to the at least one processor 31 in communication, wherein the memory stores a computer program executable by the at least one processor. The processor 31 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 32 or loaded from the storage unit 38 into the random access memory (RAM) 33. In the RAM 33, various programs and data required for the operation of the electronic device 30 can also be stored. The processor 31, the ROM 32, and the RAM 33 are connected to each other through a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0124] A plurality of components in the electronic device 30 are connected to the I / O interface 35, including: an input unit 36, such as a keyboard, a mouse, etc.; an output unit 37, such as various types of displays, speakers, etc.; a storage unit 38, such as a magnetic disk, an optical disk, etc.; and a communication unit 39, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 39 allows the electronic device 30 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0125] The processor 31 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 31 performs various methods and processes described above, such as a detection method:

[0126] Obtaining monitored data, and performing data transformation on the monitored data to obtain target data; the target data is data subject to normal distribution;

[0127] Determining an anomaly detection result based on the target data and a control chart.

[0128] In some embodiments, the detection method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 38. In some embodiments, portions of or all of the computer program can be loaded onto the electronic device 30 via, e.g., ROM 32 and / or communication unit 39. When a computer program is loaded onto the RAM 33 and executed by the processor 31, one or more of the steps of the above-described detection method can be performed. Alternatively, in other embodiments, the processor 31 can be configured to perform the detection method by other means, e.g., with the aid of firmware.

[0129] The various implementations of the system and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a load programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0130] Computer programs used to implement the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor of the machine, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0131] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0132] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0133] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0134] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. Servers can be cloud servers, also known as cloud computing servers or cloud hosts, which are a host product in the cloud computing service system to solve the defects of great management difficulty and weak business scalability in traditional physical hosts and VPS services.

[0135] In an embodiment, the present embodiment further includes a computer program product comprising a computer program which, when executed by a processor, implements the detection method of any of the embodiments of the present application.

[0136] The computer program product can be implemented in one or more computer program languages, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0137] It should be understood that the various forms of flow shown above can be reordered, added to, or deleted from without departing from the scope of the present application. For example, the steps recited in the present application can be performed in parallel, in series, or in a different order, without departing from the desired results of the technical solutions of the present application, and are not limited herein.

[0138] The above detailed description does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A detection method, characterized in that, include: Acquire the monitored data and perform data transformation on the monitored data to obtain the target data; The target data is data that follows a normal distribution; The anomaly detection results are determined based on the target data and control chart.

2. The method according to claim 1, characterized in that, The monitored data is transformed to obtain target data, including: The monitored data is input into the data transformation model to obtain the target data; the data transformation model includes at least one data transformation sub-model, which is composed of a Transformer network and a hybrid loss function.

3. The method according to claim 2, characterized in that, The monitored data is input into a data transformation model to obtain target data, including: The monitored data is input into the Transformer network to obtain the predicted data; The predicted data is optimized based on the hybrid loss function to obtain the target data.

4. The method according to claim 3, characterized in that, The monitored data is input into the Transformer network to obtain predicted data, including: The monitored data is input into the Transformer network, word embedding is performed and position encoding is added to obtain the embedding vector; The embedded vector is decomposed into three vectors: query, key, and value. A multi-head attention mechanism is then used to decompose the query, key, and value into multiple heads, and attention is calculated for each head separately. The attention of all heads is concatenated and the results are integrated through linear transformation. The hidden state is obtained through layer normalization and residual linking. The hidden states are mapped to the mean and standard deviation, and the predicted data is determined based on the mean and standard deviation.

5. The method according to claim 3, characterized in that, The predicted data is optimized based on the hybrid loss function to obtain target data, including: The negative log-likelihood loss is determined based on the predicted data and the monitored data. Obtain the negative value of the test statistic, and construct a mixed loss function based on the negative value of the test statistic and the negative log-likelihood loss; The predicted data is optimized based on the hybrid loss function to obtain the target data.

6. The method according to claim 1, characterized in that, Determining anomaly detection results based on the target data and control charts includes: Obtain the mean and standard deviation of the target data, and determine the control limits based on the mean and standard deviation of the target data; Plot the data points on the control chart and mark the control limits; If any data point exceeds the control limit, the anomaly detection result is determined to be that the data is abnormal.

7. A detection device, characterized in that, include: The acquisition and conversion module is used to acquire the monitored data and convert the monitored data to obtain the target data. The target data is data that follows a normal distribution; The determination module is used to determine the anomaly detection result based on the target data and the control chart.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the detection method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the detection method according to any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the detection method according to any one of claims 1-6.

Images