Online Anomaly Detection Method and Device Based on Optimal Segmentation of Isolated Forests Using Satellite Telemetry Data

Abstract

This invention discloses an online anomaly detection method and apparatus for satellite telemetry data based on optimal segmentation of isolated forests. The method includes: an offline stage, training a BSIForest model using historical satellite telemetry data. This model employs a two-dimensional optimal hyperplane partitioning strategy when dividing isolated tree nodes, using the midpoint of the subinterval with the lowest histogram frequency as the partitioning point, thereby effectively suppressing the "ghosting" phenomenon that occurs between clusters and in parallel axis regions in traditional algorithms; an online stage, calculating anomaly scores for each sample of telemetry data, and combining a threshold and sliding window local anomaly rate mechanism to accurately identify and output continuous anomaly windows. Through an incremental update training strategy, the detection model can cope with concept drift caused by changes in the orbital environment. This invention has been verified on real satellite power system telemetry data: the single-sample anomaly detection time is less than 0.2 milliseconds, and there are no missed or false alarms in the anomaly sequence, meeting the requirements for real-time, high-reliability anomaly detection for satellites.

Description

Technical Field

[0001] This invention relates to the field of satellite telemetry technology, and in particular to an online anomaly detection method for satellite telemetry data based on the BestSplit Isolation Forest (BSIForest) algorithm. Background Technology

[0002] During satellite operation, its telemetry data is the sole basis for ground control personnel to understand the status of onboard equipment. With the increasing volume and dimensionality of satellite telemetry data, traditional threshold- or statistical anomaly detection methods are no longer sufficient to meet real-time and accuracy requirements. Isolation Forest (IForest) is a typical unsupervised anomaly detection algorithm with advantages such as linear complexity, no need for labeled samples, and ease of parallelization. However, it only randomly selects a single dimension each time the data space is partitioned, resulting in a large amount of dimensional information not being utilized and the "ghosting" phenomenon easily appearing in sparse regions, thus reducing detection reliability. Furthermore, for anomaly detection in satellite telemetry data, it is desirable not only to detect the anomalous samples themselves but also to identify continuous anomalous telemetry sequences to provide richer data support for ground personnel in analyzing anomalies.

[0003] Therefore, there is an urgent need for an improved isolated forest algorithm to overcome the above-mentioned shortcomings and to achieve online anomaly detection of satellite telemetry data. Summary of the Invention

[0004] In view of the above problems, this invention provides an online anomaly detection method for satellite telemetry data based on Optimal Segmented Isolated Forest (BSIForest). This method improves the accuracy of anomaly detection by optimizing the data space partitioning method, suppressing the "ghosting" phenomenon, and realizing the detection of abnormal telemetry sequences by calculating the local anomaly rate.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests, the method comprising an offline stage and an online stage;

[0006] Offline phase: Using historical satellite telemetry data as the dataset, the BestSplit Isolation Forest (BSIForest) algorithm is used to train isolated trees as an anomaly detection model;

[0007] Online phase: For the satellite telemetry samples to be detected, the anomaly score of the samples is calculated using the anomaly detection model trained in the offline phase, the local anomaly rate is obtained based on threshold comparison, and the anomaly telemetry sequences are marked.

[0008] Furthermore, the BSIForest algorithm, in determining the optimal segmentation, includes:

[0009] S1: For a dataset with d-dimensional attributes, randomly generate d-dimensional Gaussian vectors and standardize them to obtain vectors. ;

[0010] S2: For the standardized vector Randomly select a 2-dimensional attribute from the d-dimensional attributes, and set the attribute values ​​corresponding to the unselected dimensions to 0. The updated vector will then... Denotes the normal vector of a hyperplane;

[0011] S3: Project the sample to be segmented onto the normal vector. This yields the set of projected values ​​Y;

[0012] S4: Divide the Y value range evenly into m sub-intervals and calculate the sample frequency f of each sub-interval;

[0013] S5: Find the sub-interval with the smallest sample frequency f, and use the midpoint of this interval as the candidate split point p:

[0014] S6: Repeat S1~S5 until a subinterval of f=0 is found, or the number of repetitions reaches the set number; return the optimal split point p and normal vector corresponding to the minimum f value. .

[0015] Furthermore, the BSIForest algorithm, when constructing the isolated tree, includes:

[0016] B1: Determine the normal vector for the optimal split. and the dividing point p;

[0017] B2: Project the sample to be segmented onto the normal vector. The sample with projection value ≤ p is placed in the left node of the isolated tree, and the sample with projection value > p is placed in the right node of the isolated tree.

[0018] B3: Recursively divide the left and right nodes of the isolated tree according to B1 and B2 until the height of the tree reaches the limit value.

[0019] Furthermore, in the online phase, anomaly scores for telemetry samples are calculated based on the partition path length of the samples on the isolated tree.

[0020] Furthermore, the path length of the telemetry sample on the isolated tree is obtained based on the number of edges traversed by the sample from the root node of the isolated tree to the leaf node where the sample is located.

[0021] Furthermore, the method for identifying abnormal telemetry sequences is as follows: for a time series of telemetry data, if the abnormality rate of telemetry samples in the sequence exceeds a threshold, then the telemetry sequence is marked as an abnormal sequence.

[0022] Furthermore, the offline phase also includes updating the anomaly detection model using newly added historical data to address the conceptual drift of telemetry data.

[0023] Secondly, the present invention also provides an online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests, including a memory and one or more processors. The memory stores executable code, and when the processor executes the executable code, it implements the online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests.

[0024] Thirdly, the present invention also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the aforementioned method for online anomaly detection of satellite telemetry data based on optimal segmentation of isolated forests.

[0025] Fourthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method for online anomaly detection of satellite telemetry data based on optimal segmentation of isolated forests.

[0026] The beneficial effects of this invention are:

[0027] Compared with the prior art, the present invention has the following advantages:

[0028] 1. It can adapt to unsupervised application scenarios. No abnormal label information is required during model training, and historical data can be used directly for training.

[0029] 2. Fast model training: The algorithm based on isolated forests has linear complexity during model training and detection;

[0030] 3. It is easy to parallelize, forming isolated trees that can be trained and detected independently;

[0031] 4. Improved anomaly detection accuracy: This invention can suppress parallel axis ghosting and inter-cluster ghosting;

[0032] 5. It can detect abnormal sequences in telemetry sequences. On real telemetry datasets of real satellite power systems, it can detect all abnormal sequences. Attached Figure Description

[0033] Figure 1 This is a flowchart of the method of the present invention.

[0034] Figure 2 These are the training samples provided in this embodiment.

[0035] Figure 3 This is the test sample used in this embodiment.

[0036] Figure 4 This refers to the test duration of the present invention in this embodiment.

[0037] Figure 5 This is the result of anomaly detection in this embodiment of the present invention.

[0038] Figure 6 This is a schematic diagram of the "ghosting" suppression effect of the present invention in this embodiment, wherein (a) is the "ghosting" phenomenon of the traditional IFOres method, and (b) is the "ghosting" suppression effect of the present invention.

[0039] Figure 7 This is a schematic diagram of the test set grid division generated by the present invention.

[0040] Figure 8 This is a schematic diagram of the structure of an online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests, provided by the present invention. Detailed Implementation

[0041] The present invention will now be further described with reference to the accompanying drawings and specific embodiments.

[0042] like Figure 1 As shown, this invention provides an online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests, including an offline stage and an online stage, specifically including the following steps:

[0043] Offline phase:

[0044] Step 1: Obtain a set D of N d-dimensional satellite historical telemetry data samples, and randomly select from D. The samples form a set D';

[0045] Step 2: Using the Best Split Isolation Forest (BSIForest) algorithm, recursively partition the samples in D' into left and right sub-samples according to a binary tree structure until there are fewer than 3 samples to be partitioned, or the tree height reaches the limit h. lim And mark the undivideable samples as leaf nodes. Constraint value h lim The calculation method is as follows:

[0046]

[0047] In the formula Indicates the number of samples in the training set; To round up. Limiting the tree height aims to reduce the computational cost of constructing an isolated tree. The specific process of constructing an isolated tree is as follows:

[0048] Step 2-1: Determine the optimal normal vector of the dividing surface for this partitioning. and the dividing point p b The specific process is as follows:

[0049] Step 2-1-1: Generate vectors using d-dimensional Gaussian distribution and to Standardize to obtain vectors ;

[0050] Step 2-1-2: Randomly select 2D attributes from the d-dimensional attributes, and assign the v values ​​corresponding to the unselected dimensions to the attributes. i The value is set to 0, 1≤i≤d. At this time, the vector... It represents the normal vector of a certain hyperplane;

[0051] Step 2-1-3: Project the sample to be segmented onto the vector And form a set of projected values. Here, n represents the total number of samples to be segmented;

[0052] Step 2-1-4: Divide the interval [min(Y), max(Y)] into m equal sub-intervals, where min(Y) and max(Y) represent the minimum and maximum values ​​of the projected value set, respectively. The calculation method for m is as follows:

[0053]

[0054] In the formula, n represents the number of samples to be segmented. This is for rounding up.

[0055] Step 2-1-5: Calculate the sample frequency f for each sub-interval, and find the sub-interval i with the lowest f. And i satisfies .

[0056] Step 2-1-6: Based on the value of i obtained in Step 2-1-5, determine the candidate split point p according to the following formula:

[0057]

[0058] Step 2-1-7: Repeat steps 2-1-1 to 2-1-6 until a subinterval where f=0 is found, or the number of repetitions reaches the limit value hps; return the split point p and normal vector corresponding to the minimum f value. .

[0059] Step 2-1-8: Combine the split point p and normal vector returned from Step 2-1-7 Record the optimal split point for this partition. and the normal vector of the optimal dividing surface ;

[0060] Step 2-2: Project the sample to be segmented onto the optimal segmentation surface normal vector of the current tree layer. And compare the projected value with the optimal split point of the current level of the tree. In comparison, for projected values The sample is assigned to the left node of this level of the tree, and the projected value is... The sample is assigned to the right node of this level of the tree.

[0061] Step 2-3: Recursively partition the left and right nodes of the current level of the tree according to Step 2-1 and Step 2-2 until the number of samples to be partitioned is less than 3, or the height of the tree reaches the limit value. Samples that cannot be further divided are marked as leaf nodes.

[0062] Step 3: Repeat steps 1 to 2 until the number of isolated trees constructed reaches the preset t value.

[0063] Online phase:

[0064] Step 4: For the satellite telemetry sample x to be detected, calculate the sample anomaly score using the anomaly detection model trained in the offline phase. The specific process is as follows:

[0065] Step 4-1: For the i-th isolated tree (i=1,2,…,t), starting from the root node of the isolated tree, recursively project the sample x onto the normal vector of the best split surface of this layer of the tree. And compare the projected value with the optimal split point of the current level of the tree. In comparison, if the projected value If the sample x is not found, then the sample x is substituted into the left node of the current level of the tree to continue the partitioning until the leaf node of the tree is reached; if the projection value is not found, then the sample x is substituted into the left node of the current level of the tree to continue the partitioning. If the sample x is not found, it will be taken to the right node of the current level tree and the partitioning will continue until the leaf node of the tree is reached.

[0066] Step 4-2: For the i-th isolated tree (i=1,2,…,t), denoted as the height of the leaf node containing sample x at the end of the partition. And calculate the partition path length of sample x on the isolated tree according to the following formula. :

[0067]

[0068]

[0069] In the formula, c is an adjustment factor used to harmonize the height limit processing during the isolated tree construction process; n represents the number of samples contained in the leaf node where sample x is located when the partition is completed.

[0070] Step 4-3: Repeat steps 4-1 and 4-2 until the partition path length of sample x on all isolated trees is calculated. , i=1,2,…,t.

[0071] Step 4-4: Calculate the outlier score of sample x according to the following formula:

[0072]

[0073] In the formula t represents the number of training set samples; t represents the number of isolated trees.

[0074] Step 5: Based on Step 4, and using the comparison results between the anomaly score and the threshold, mark the abnormal telemetry samples. Specifically, for telemetry sample x, if its anomaly score... If the sample x is an anomaly, then the sample x is labeled as an anomaly; if its anomaly classification is... If the threshold is 0, then sample x is labeled as normal. Here, thresh is the anomaly threshold, with a value range of [0.6, 1].

[0075] Step 6: Based on Step 5, and comparing the local anomaly rate of the telemetry time series with the threshold, mark the abnormal telemetry sequences. Specifically, this can be described as follows: for telemetry sample sequences... W represents the sequence length, which is a time series arranged in chronological order. After detection in steps 4 and 5, the abnormal sample set obtained from sequence X is represented as follows, sorted by sample number in ascending order: , here o i This represents the index of the i-th abnormal sample in sequence X. , w is the total number of abnormal samples, and has If there exist i and j that satisfy the following equation, then mark them as... This is an abnormal sequence.

[0076]

[0077] In the formula This represents the local anomaly rate threshold, with a value range of (0,1]. The higher the value, the higher the anomalous rate of the generated abnormal sequences; especially in When the abnormal sequence is obtained, all the samples contained in it are abnormal samples.

[0078] To address the conceptual drift in telemetry data caused by factors such as satellite orbital altitude, solar activity, component decay, and changes in operating mode, the historical dataset should be updated regularly (monthly or quarterly) or irregularly (as soon as possible after a change in satellite operating mode). The anomaly detection model should then be retrained in the order of steps 1, 2, and 3.

[0079] This invention takes anomaly detection in satellite telemetry data as an example to specifically illustrate an online anomaly detection method based on optimal partitioning of isolated forests, which includes the following steps:

[0080] Offline training

[0081] Data Preparation: Telemetry data of the input voltage of the solar cells in the ±X and ±Y planes of the Tianping-2B satellite from April 12 to May 31, 2022, were selected as experimental data, totaling 17,201 samples. Among them, 2,330 samples with normal energy levels were used for offline training. The training samples are as follows: Figure 2 The remaining 14,871 samples were used for online testing, and the test samples are as follows: Figure 3 .

[0082] Parameter settings: Sample dimensions Training set size Limit on the number of times the optimal dividing facet can be found. Total number of isolated trees .

[0083] Step 1: Randomly select 512 samples from 2330 samples to form a training set;

[0084] Step 2: Using the BSIForest algorithm, recursively perform two-dimensional optimal hyperplane partitioning on each isolated tree until the height of the isolated tree reaches the specified value. Stop when there are fewer than 3 node samples.

[0085] Step 3: Repeat steps 1 and 2 until 100 isolated trees have been trained.

[0086] Online testing

[0087] Parameter settings: Abnormal threshold Local anomaly rate threshold .

[0088] Step 4: Use the trained isolation trees to partition the test sample x sequentially, and record the partition path length of each isolation tree for sample x. Let i = 1, 2, ..., 100, and calculate the outlier score of sample x according to the following formula:

[0089]

[0090] Step 5: For telemetry sample x, if its abnormal distribution... If the sample x is an anomaly, then the sample x is labeled as an anomaly; if its anomaly classification is... If so, then the sample x is labeled as normal.

[0091] Figure 4 The results of anomaly detection on the test sample set by this invention identified a total of 3258 abnormal samples.

[0092] Figure 5 To measure the time variation of 200 traversals of all test samples (a total of 14,871) using the method of this invention, the maximum time required to complete one detection of 14,871 samples is 2.4688 seconds. Based on this, the time required to detect one sample is less than 0.2 milliseconds, thus meeting the online anomaly detection requirements of the Tianping-2B satellite telemetry data with an update frequency of 0.5Hz.

[0093] Step 6: Based on Step 5, sort the 3258 abnormal samples in chronological order to form an abnormal sample sequence. And determine the abnormal sequence according to the following formula:

[0094]

[0095] Table 1 summarizes the abnormal sequences with a length exceeding 20 detected from the test sample set by this invention.

[0096] Table 1. Anomaly Sequence Information of Power Supply Telemetry Data for a Certain Satellite Model

[0097]

[0098] To verify the accuracy of the detection results, this invention utilizes expert knowledge of power systems to analyze the abnormal sequences one by one, with the following results:

[0099] (1) Sequences [1398, 211], [1886, 492], [7384, 1047], and [13298, 311]: During these periods, the onboard power supply was under overvoltage. At this time, the power supply MPPT module no longer outputs engineering data to the satellite service. Therefore, the input voltage data of each panel in the power supply telemetry during these periods remained the values ​​under the switching between shadow and illumination. Since these values ​​differed significantly from the main training set data, it is considered correct that the BSIForest model identified these four sequences as anomalous. For these four anomalous sequences, the IForest model only detected two of them.

[0100] (2) Sequence [4972, 901]: During this period, the solar cell input voltage is too low, the load bus voltage is below 15.10V, and the onboard energy is in an undervoltage state. Both the IForest model and the BSForest model proposed in this invention can detect this abnormal sequence.

[0101] (3) Sequence [3903, 157]: During the first 30 seconds of this period, the satellite software was reset. After the reset, the payload software module was disabled, and the satellite no longer received engineering data reported by the power system MPPT module. At the same time, telemetry was filled with random initial values. Since the filled values ​​of the voltages of each surface differed significantly from the main training set, it was considered that the BSIForest model correctly identified this sequence as an anomaly. The IForest model failed to detect this anomaly sequence.

[0102] like Figure 6 As shown, this invention can suppress parallel-axis ghosting and inter-cluster ghosting. The ghosting suppression effect of this invention's method is compared with that of the Isolation Forest algorithm based on an artificially synthesized dataset. The specific implementation is as follows:

[0103] The first step is to generate two training sets. Training set 1 consists of 1000 random samples (500 samples per model) generated by two two-dimensional Gaussian models. The mean vectors of these two Gaussian models are [10, 0] and [0, 10], respectively, and the covariance matrix of each model is [[1,0],[0,1]]. Training set 2 consists of 2000 random samples (500 samples per model) generated by four two-dimensional Gaussian models. The mean vectors of these four Gaussian models are [10,0], [0,10], [0,0], and [10,10], respectively, and the covariance matrix of each model is [[1,0],[0,1]].

[0104] The second step is to generate a test set. The test set consists of 2500 samples formed by dividing a square region with an x-axis range of [-5, 15] and a y-axis range of [-5, 15] into a 50×50 grid. For example... Figure 7 As shown.

[0105] The third step is to train the models on training sets 1 and 2 using the traditional method and the method of the present invention, respectively, and to denot the trained models as IFOreest-1 model (the model trained on training set 1 using the traditional method), IFOreest-2 model (the model trained on training set 2 using the traditional method), BSIForest-1 model (the model trained on training set 1 using the method of the present invention), and BSIForest-2 model (the model trained on training set 2 using the method of the present invention).

[0106] The fourth step involves sequentially using the four detection models obtained in step three to calculate anomaly scores on the test set samples, generating four anomaly score heatmaps, such as... Figure 6 As shown in the heatmap, the higher the score value, the yellower the color. Figure 6 The abnormal score for the intermediate-high line is 0.6.

[0107] "Ghosting" points refer to sample points that cannot be identified as abnormal by the detection model. The area formed by "ghosting" points is called the "ghosting region". The size of the "ghosting region" reflects the degree of missed detection by the detection model.

[0108] from Figure 6 It can be seen that the "ghosting" region generated by the IForest detection model includes inter-cluster regions and some regions parallel to the coordinate axes, and the "ghosting" region is relatively large; the BSIForest detection model proposed in this invention can effectively suppress the "ghosting" phenomenon.

[0109] Corresponding to the aforementioned embodiment of the online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests, the present invention also provides an embodiment of an online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests.

[0110] See Figure 8 The present invention provides an online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests, comprising a memory and one or more processors. The memory stores executable code, and when the processor executes the executable code, it is used to implement an online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests as described in the above embodiments.

[0111] The embodiment of the online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests provided by this invention can be applied to any device with data processing capabilities, such as a computer. The device embodiment can be implemented through software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 8 The diagram shown is a hardware structure diagram of any device with data processing capabilities, which is an online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests provided by the present invention. Except for... Figure 8 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0112] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0113] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0114] This invention also provides a computer-readable storage medium storing a program that, when executed by a processor, implements an online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests, as described in the above embodiments.

[0115] The computer-readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device of any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of any data processing device. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0116] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method for online anomaly detection of satellite telemetry data based on optimal segmentation of isolated forests.

[0117] The above embodiments are used to explain and illustrate the present invention, but not to limit the present invention. Any modifications and changes made to the present invention within the spirit and scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A method for online anomaly detection of satellite telemetry data based on optimal segmentation of isolated forests, characterized in that, The method includes an offline phase and an online phase; Offline phase: Using historical satellite telemetry data as the dataset, the isolated tree is trained as an anomaly detection model using the optimal segmentation isolated forest algorithm. During the training process, the optimal segmentation surface, which includes the normal vector and the segmentation point, is found for each segmentation. The sample to be segmented is projected onto the normal vector of the optimal segmentation surface of the corresponding layer tree and compared with the optimal segmentation point to divide the nodes of the corresponding layer tree. An isolated tree that can ensure the correct differentiation of samples is constructed, while suppressing parallel axis and inter-cluster ghosting. The BSIForest algorithm, in determining the optimal segmentation, includes: S1: For a dataset with d-dimensional attributes, randomly generate d-dimensional Gaussian vectors and standardize them to obtain vectors. ; S2: For the standardized vector Randomly select a 2-dimensional attribute from the d-dimensional attributes, and set the attribute values ​​corresponding to the unselected dimensions to 0. The updated vector will then... Denotes the normal vector of a hyperplane; S3: Project the sample to be segmented onto the normal vector. This yields the set of projected values ​​Y; S4: Divide the Y value range evenly into m sub-intervals and calculate the sample frequency f of each sub-interval; S5: Find the sub-interval with the smallest sample frequency f, and use the midpoint of this interval as the candidate split point p: S6: Repeat S1~S5 until a subinterval of f=0 is found, or the number of repetitions reaches the set number; return the optimal split point p and normal vector corresponding to the minimum f value. ; The BSIForest algorithm, when constructing an isolated tree, includes: B1: Determine the normal vector for the optimal split. and the dividing point p; B2: Project the sample to be segmented onto the normal vector. The sample with projection value ≤ p is placed in the left node of the isolated tree, and the sample with projection value > p is placed in the right node of the isolated tree. B3: Recursively divide the left and right nodes of the isolated tree according to B1 and B2 until the height of the tree reaches the limit value; Online phase: For the satellite telemetry samples to be detected, the anomaly detection model trained in the offline phase is used to recursively project the samples from the root node of the isolated tree to the optimal split surface normal vector of the corresponding layer tree. The sample is compared with the optimal split point to divide the nodes of the corresponding layer tree. The anomaly score of the sample is calculated based on the length of the split path. The local anomaly rate is obtained based on the threshold comparison, and the anomaly telemetry sequence is marked.

2. The online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests according to claim 1, characterized in that, In the online phase, anomaly scores for telemetry samples are calculated based on the partition path length of the sample on the isolated tree.

3. The online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests according to claim 2, characterized in that, The path length of the telemetry sample on the isolated tree is obtained by counting the number of edges traversed from the root node of the sample to the leaf node where the sample is located.

4. The online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests according to claim 1, characterized in that, The method for identifying abnormal telemetry sequences is as follows: for a time series of telemetry data, if the abnormality rate of telemetry samples in the sequence exceeds a threshold, the telemetry sequence is marked as an abnormal sequence.

5. The online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests according to claim 1, characterized in that, The offline phase also includes updating the anomaly detection model using newly added historical data to address conceptual drift in telemetry data.

6. An online anomaly detection device for satellite telemetry data based on optimal segmentation of isolated forests, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that, When the processor executes the executable code, it implements the online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests as described in any one of claims 1-5.

7. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests as described in any one of claims 1-5.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the online anomaly detection method for satellite telemetry data based on optimal segmentation of isolated forests as described in any one of claims 1-5.

Images