Neural network anomaly detection method for multi-scale feature extraction and time-frequency feature alignment

Abstract

The invention relates to a neural network anomaly detection method based on multi-scale feature extraction and time-frequency feature alignment. The method comprises the steps of preprocessing time sequence data; performing multi-scale transformation on the data through a preset sliding window strategy, and extracting features of three scales by using two layers of BiLSTM; calculating the similarity of the inter-scale feature subsequences and constructing a similarity matrix; fusion weight calculation and feature fusion of different scales are carried out based on similarity, and weighted fusion and normalization are carried out; the fused features are converted to a frequency domain through short-time Fourier transform, and alignment is carried out; and inputting the aligned data into a neural network decoder to realize anomaly detection of the intelligent operation and maintenance time sequence. According to the method, fine features of time series data can be greatly improved, and the model anomaly detection capability is enhanced; realization is easy and precision is high; the method can be used in the field of time sequence anomaly detection and prediction, and realizes monitoring of the system and industrial equipment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of time series processing, and in particular to a neural network anomaly detection method for multi-scale feature extraction and time-frequency feature alignment. BACKGROUND

[0002] With the rapid development of the Internet and information technology, the scale and complexity of computer systems continue to increase. Modern society has entered the digital and information age. Various data emerge at an explosive rate, and these data contain a variety of information and value. However, these data also pose a huge security risk to enterprises and individuals. These risks include not only attacks by network hackers and intrusion of viruses into data, but also some internal security incidents such as data leakage caused by improper operation and improper use of employees. Anomaly detectors detect and identify abnormal behavior by comparing differences between time series data and normal behavior patterns. Traditional methods such as rule-based methods rely on the setting of artificial rules, while statistical-based methods can be disturbed by uneven data distribution and noise, greatly increasing the operation and maintenance cost. Limited by complex anomaly detection scenarios and massive time series data, the detection accuracy and model robustness face a bottleneck.

[0003] Therefore, the concept of intelligent operation and maintenance has emerged. Compared with traditional statistical-based methods, intelligent operation and maintenance introduces artificial intelligence into the field of operation and maintenance, replacing traditional methods with machine learning. Machine learning methods have the characteristics of strong adaptability and high detection accuracy. By using big data, machine learning and other technologies, intelligent analysis and anomaly detection of time series data can be achieved. The document with the application number CN118429910A discloses a traffic video anomaly detection method based on a multi-scale bottleneck Transformer. The method processes RGB, optical flow and audio data through a multi-modal fusion module, which specifically includes: a single-modal encoder (main network + projection layer + Transformer layer) extracts features of each modality; a multi-scale bottleneck Transformer module gradually compresses the modality features and uses a bottleneck token to transfer information; a weight fusion module weights and fuses the dual-modality features based on the bottleneck token; and the semantic information of the cross-modality features is aligned using a temporal consistency contrast loss to solve the problem of asynchronous modality. However, this scheme has the following problems: due to the use of a multi-level Transformer structure, the level is complex and multiple modalities need to be processed, so the model computation load is significantly increased, making it difficult to meet the real-time detection requirements of traffic scenarios; since it relies on optical flow characteristics and audio synchronization, and does not provide a fault tolerance mechanism for missing modalities, it is easily affected by sensor interference or environmental interference during actual deployment, and the robustness is insufficient. In summary, although intelligent operation and maintenance combines machine learning and other methods to detect abnormal values in time series data, the detection results are still affected by data quality, model maintenance and engineering complexity.

[0004] How to detect abnormal behavior more efficiently, accurately and quickly is the key direction of the current field. SUMMARY

[0005] The present application provides a multi-scale feature extraction and time-frequency feature alignment neural network anomaly detection method to overcome the problems of poor detection accuracy and low detection efficiency in the prior art.

[0006] To achieve the purpose of the present application, the technical solution provided by the present application is as follows: a multi-scale feature extraction and time-frequency feature alignment neural network anomaly detection method, comprising the following steps: Step one, the time series data is preprocessed by data cleaning and normalization to obtain normalized data, and the normalized original time series data is enhanced by a sliding window to obtain an enhanced data tensor, and the enhanced data is divided to obtain a final training set of time series data; Step two, input the training set of time series data into a multi-scale feature extraction module, perform multi-scale transformation on the preprocessed time series data through a preset sliding window strategy, and use two layers of BiLSTM to extract high, medium and low scale data features; Step three, first, calculate the similarity between high-medium, medium-low and high-low scale feature subsequences; construct a similarity matrix according to the similarity; then perform similarity-based fusion weight calculation; then, through a multi-scale feature fusion module, perform feature fusion of different scales based on the similarity measurement method, and perform weighted feature fusion and normalization on the extracted data features; Step four, input the data extracted and fused by the multi-scale feature fusion module into a time-frequency feature conversion module, convert the time domain features to the frequency domain using short-time Fourier transform, and align the data after the time-frequency feature conversion module through a time-frequency feature alignment module to obtain multiple groups of time-frequency aligned data; Step five, input the multiple groups of time-frequency aligned data obtained in step four into a neural network decoder, and use the reverse propagation order of BiLSTM to perform data reconstruction tasks, and obtain data blocks after data reconstruction through adaptive residual fusion; analyze the obtained data blocks, set parameter conditions, calculate the loss using mean square error, and realize the anomaly detection task of intelligent operation and maintenance time series.

[0007] Further, in the above step one, the transformed time series data is a data dimension that can be recognized by the model encoder, and the data dimension is in the form of a three-dimensional array, representing the number of samples, input dimensions and sequence length respectively.

[0008] Further, in the above step two, when multi-scale transformation is performed, the expressions corresponding to the multi-scale down-sampled data are respectively: Here, transpose of the input state representing high-scale feature, mid-scale feature state representing the output, B representing the size of each batch.

[0009] Further, in the above step three, the formula for calculating the similarity degree between different scales is as follows: 。

[0010] Further, in the above step three, the formula for constructing the similarity matrix is as follows: 。

[0011] Further, in the above step three, the formula for calculating the similarity-based fusion weight is as follows: The formula for calculating the dynamic weight is as follows: 。

[0012] Compared with the prior art, the present application has the following beneficial effects: 1、The present application proposes a BiLSTM-AutoEncoder fusion module based on multi-scale feature extraction, which uses two layers of BiLSTM as an encoder to gradually extract different scale features of time series data and perform fusion, avoiding the high complexity calculation of attention mechanism, and using a similarity measurement based method to highlight more important fusion features, effectively solving the information redundancy of different scales and enhancing the extraction ability of key features.

[0013] Due to the use of high, medium and low scale feature extraction and similarity measurement based feature fusion mechanism, the present application can greatly improve the subtle features of time series data and enhance the model anomaly detection detection ability. 2、The present application proposes a time-frequency feature alignment mechanism, which learns the time dynamic characteristics through the BiLSTM network, explicitly aligns the time series and frequency domain information of different scale or source features, effectively solves the time inconsistency problem between features, and improves the consistency of features. The F1-Score of data anomaly detection after processing by the method of the present application can reach 92.13, and the precision can reach 93.68, which greatly improves the efficiency of time series data anomaly detection.

[0014] The method solves the problem of low efficiency of large-scale time sequence anomaly detection in current intelligent operation and maintenance through a neural network on the basis of the original experiment and unchanged hardware, by including a multi-scale feature extraction module, a multi-scale feature fusion encoder, a time-frequency conversion alignment module and a decoder, etc.

[0015] 3、The time sequence data anomaly detection method detects anomalies in time sequence data of different types, and the technology combines BiLSTM and AutoEncoder to provide an innovative multi-scale feature fusion method, enhancing the recognition and extraction ability of different types of data features. The provided method is easy to implement, can help realize full-dimensional collaborative detection of complex time sequence anomalies in the field of industrial equipment detection in intelligent operation and maintenance, and can improve data processing speed by setting sequence length and sliding window to enhance the detection effect of neural networks on large-scale time sequence data, greatly improving the intelligent operation and maintenance time sequence data anomaly detection capability. Not only can be used in the field of time sequence anomaly detection, but also can be used in the field of time sequence prediction, realizing the monitoring of systems and industrial equipment, and has very wide application range. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a flowchart of the method of the present application; Figure 2 is a flowchart of data preprocessing of the present application; Figure 3 is a multi-scale feature fusion structure diagram of the present application; Figure 4 is a neural network anomaly detection process diagram of the present application. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the embodiments and the drawings.

[0018] In this embodiment, the processing object is time sequence data. Referring to Figure 1 The present application provides a neural network anomaly detection method for multi-scale feature extraction and time-frequency feature alignment for specific objects, specifically including the following steps: Step one, referring to Figure 2 The time sequence data is subjected to data cleaning and normalization preprocessing to obtain normalized data, which is represented as a dimension tensor with a shape of [sample number, input dimension, sequence length]. The normalized original time sequence data is subjected to data enhancement through a sliding window to obtain an enhanced data tensor. The enhanced data is subjected to data division to obtain the final input data. The specific steps of the data cleaning and normalization processing are as follows: 1. Data reading and format conversion: read the dataset through the Dataloader, convert the original sensor data into the format of two-bit data, and adapt to the subsequent time series modeling requirements; 2. Dynamic normalization: use the MinMaxScaler principle to realize normalization operation, calculate the global minimum value and global maximum value, and ensure that the data range is mapped to the [0, 1] interval.

[0019] The data enhancement refers to data enhancement through a sliding window, and different time period local sequences are generated by controlling the step size and repeatedly sliding the window.

[0020] The data division divides the data module by random shuffling and division. In this embodiment, the time series data dataset obtained is divided into a training set and a validation set in a ratio of 3:7.

[0021] In this embodiment, the model autoencoder is a convolutional autoencoder (Convolutional AutoEncoder) based on a convolutional neural network. The data dimension it can recognize is a three-dimensional array, which represents the number of samples, input dimension, and sequence length, respectively.

[0022] Step two, input the training set of time series data into the multi-scale feature extraction module, and perform multi-scale transformation on the preprocessed time series data through the preset sliding window strategy. Two layers of BiLSTM are used to extract high, medium, and low scale data features respectively. The multi-scale feature extraction module adds a multi-scale feature division module and an extraction module in the encoder part of the model autoencoder, which is used to generate three-scale feature subsequences by the preset sliding window strategy. It can effectively eliminate random noise in the data, align the data dimension, and achieve the effect of down-sampling.

[0023] In this embodiment, one-dimensional convolution is used for 2 times down-sampling processing, as shown in Figure 3 The expression corresponding to the data after multi-scale down-sampling of the input time series data through the multi-scale feature division module is: Here, represents the transpose of the high-scale feature input state, represents the output medium-scale feature state, B represents the size of each batch.

[0024] Step three, first calculate the similarity between high-medium, medium-low, high-low three scale feature subsequences; construct a similarity matrix according to the similarity; then perform similarity-based fusion weight calculation; then through the multi-scale feature fusion module, different scale feature fusion is performed based on the similarity measurement method, and more effective feature representation of the data is extracted, and the extracted data features are weighted and normalized; Specifically, the following steps are included: 3.1, the high, medium and low scale feature subsequences obtained in step two are transformed by a similarity measurement method, and the similarity between high-medium, medium-low and high-low scales is calculated. The formula for calculating the similarity between different scales is as follows: Here, , , Global average pooling is performed on high, medium and low scales to reduce the number of parameters and computational complexity, and L represents the length of the original time series data.

[0025] 3.2, similarity matrix construction: the similarity between different scales calculated in 3.1 is used to construct a similarity matrix, forming a structured representation, which is specifically combined into a matrix vector by calculating the similarity of all feature dimensions for each specific scale combination.

[0026] The formula for calculating the similarity matrix is as follows: 3.3, similarity-based fusion weight calculation: use similarity information to calculate the cosine similarity between different scales, dynamically determine the weight of different scale features in fusion, and the higher the similarity of the feature combination, the higher the weight in fusion, because they provide more consistent features.

[0027] The formula for calculating the cosine similarity is as follows: The formula for calculating the dynamic weight is as follows: In similarity measurement, global statistical features are extracted from each batch, and feature alignment is performed. The neural network sets parameters such as window size and model learning rate, which can maximize the reduction of noise on the data processing target detection result, and also reduce the complexity of the operation.

[0028] 3.4, normalization and weighted feature fusion: the weight calculated by similarity measurement in 3.3 is normalized and weighted feature fusion is carried out, and the data after full connection is normalized by using softmax activation function, and different scale features are fused into a unified and more effective feature representation.

[0029] The specific formula for data normalization using softmax activation function is as follows: The specific calculation formula of weighted feature fusion is as follows: Among them is the dynamic weight generated by similarity calculation.

[0030] Step four, see Figure 4 The data extracted and fused by the multi-scale feature fusion module is input into the time-frequency feature conversion module, and the time domain features are converted to frequency domain by using short-time Fourier transform, and the data after time-frequency feature conversion module is aligned by time-frequency feature alignment module to obtain multiple groups of time-frequency converted data. The specific steps of converting time domain features to frequency domain by using short-time Fourier transform and aligning include: 4.1, short-time Fourier transform is performed on the detected multi-scale feature fused data, and the time domain features are converted to frequency domain, and the model's representation ability for different types of fault features is enhanced; The specific calculation formula of time-frequency conversion is as follows: 4.2, frequency spectrum calculation and logarithmic compression are performed on the data after short-time Fourier transform, and the compressed frequency domain data is normalized and interpolated and aligned with the time domain data; The specific calculation formula of logarithmic compression is as follows: The formula for normalization and interpolation calculation is as follows: 4.3, time-frequency feature alignment: the time-frequency feature alignment layer combines the time domain multi-scale features and the frequency domain spectrum features, and aligns the time domain features after step 3.2 similarity measurement with the frequency domain features after step 3.3 time-frequency conversion, so as to present the model representation from the multi-modal angle.

[0031] First, the frequency domain features are convolved, and through convolution, a fixed size window can be slid on the time series data, and the data in the window is weighted and summed. This local operation can effectively capture the local features and patterns in the time series, The specific formula of convolution processing is as follows: The specific calculation formula of time-frequency feature alignment is as follows: Based on the above steps, the BiLSTM-AutoEncoder time series data anomaly detection neural network based on multi-scale feature extraction and time-frequency feature alignment disclosed by the application comprises a multi-scale feature extraction module, a multi-scale feature fusion module, a time-frequency feature conversion module, a time-frequency feature alignment module and a decoder module. The preprocessed time series data is input into the multi-scale feature extraction encoder, the multi-scale feature fusion module is connected with the time-frequency feature conversion alignment module, the time-frequency feature conversion alignment module is connected with the decoder, and the output of the decoder is used as the output of the neural network.

[0032] Step five, input the multiple groups of time-frequency converted data obtained in step four into the neural network decoder, and use the reverse propagation order of BiLSTM to perform the data reconstruction task, and obtain the data block after data reconstruction through adaptive residual fusion; analyze the obtained data block, set the parameter condition, calculate the loss by using the mean square error, and realize the abnormality detection task of the intelligent operation and maintenance time series.

[0033] When performing abnormality detection, first change the arrangement mode of the matrix data, then arrange them in the order of training set-validation set, and finally evaluate the reconstruction result of the neural network by using the precision and F1-Score indicators to evaluate the abnormality detection effect of the model.

[0034] The abnormality detection of the intelligent operation and maintenance time series in step five specifically comprises: The dimension of the data block matrix is corrected to [number of samples, time step, number of features], and the corrected data block is obtained. The loss of the model is calculated by using the mean square error loss, and the optimizer uses the Adam optimizer. The time series data is processed by data reconstruction, and the reconstructed data is used to realize the abnormality detection task of the time series data under the neural network based on multi-scale feature extraction.

[0035] The improvement effect of the present application is illustrated by the anomaly detection effect of the SMD data set. Meanwhile, the detection results of the time series data are evaluated by the precision, F1-Score and other evaluation standards, and it is illustrated that the data processed by the present application has the obviousness. The multiple experimental data show that for the SMD data set, the precision of the BiLSTM-AutoEncoder time series data anomaly detection neural network based on multi-scale feature extraction and time-frequency feature alignment reaches 93.68, and the F1-Score reaches 92.13.

[0036] The above only describes the preferred embodiments of the present application and is not used to limit the present application. Although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art can modify the technical solutions recorded in the foregoing embodiments or make equivalent replacement for some technical features. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A neural network anomaly detection method of multi-scale feature extraction and time-frequency feature alignment, characterized in that: Comprising the following steps: Step one, the time series data is preprocessed by data cleaning and normalization to obtain normalized data, the normalized original time series data is enhanced by sliding window to obtain enhanced data tensor, and the enhanced data is divided to obtain the final training set of time series data; Step two, input the training set of time series data into the multi-scale feature extraction module, and perform multi-scale transformation on the preprocessed time series data through the preset sliding window strategy, and use two layers of BiLSTM to extract high, medium and low scale data features respectively; Step three, first calculate the similarity between high-medium, medium-low and high-low three scale feature subsequences; According to the similarity, a similarity matrix is constructed, and then a similarity-based fusion weight calculation is performed; then, through the multi-scale feature fusion module, different scale feature fusion is performed based on the similarity measurement method, and the extracted data features are weighted and normalized; Step four, input the data extracted and fused by the multi-scale feature fusion module into the time-frequency feature conversion module, convert the time domain features to the frequency domain by using short-time Fourier transform, and align the data after the time-frequency feature conversion module through the time-frequency feature alignment module to obtain multiple groups of time-frequency aligned data; Step five, input the multiple groups of time-frequency aligned data obtained in step four into the neural network decoder, and use the reverse propagation order of BiLSTM to perform data reconstruction task, and obtain the data block after data reconstruction through adaptive residual fusion; The obtained data block is analyzed, the parameter condition is set, the loss is calculated by using mean square error, and the abnormal detection task of intelligent operation and maintenance time series is realized.

2. The method of claim 1, wherein: In the step one, the transformed time series data is a data dimension that can be recognized by the model encoder, and the data dimension is in the form of a three-dimensional array, representing the number of samples, input dimensions and sequence length respectively.

3. The method of claim 1, wherein: In the step two, when the multi-scale transformation is performed, the expressions corresponding to the multi-scale down-sampled data are as follows: Here, representing the transpose of the high-scale feature input state, representing the mid-scale feature state of the output, B representing the size of each batch.

4. The method of claim 1, wherein: In the step three, the formula for calculating the similarity degree between different scales is as follows: 。 5. The method of claim 1, wherein: In the step three, the formula for constructing the similarity matrix is as follows: 。 6. The method of claim 1, wherein: In the step three, in the similarity-based fusion weight calculation, the calculation formula of the cosine similarity is as follows: The calculation formula of the dynamic weight is as follows: 。

Images