Device system anomaly detection method and system based on double-path adaptive learning

Abstract

The application discloses a device system anomaly detection method and system based on a double-path adaptive learning, and the method comprises the following steps: obtaining an input feature matrix of a device, and sequentially performing dimension reduction, normalization, value embedding and position embedding on the input feature matrix, and then dividing the input feature matrix into continuous feature input and discrete feature input; performing continuous feature extraction on the continuous feature input to obtain continuous path output, and performing discrete feature extraction on the discrete feature input to obtain discrete path output; fusing the continuous path output and the discrete path output through perceptual attention to obtain fused features; and detecting whether the device has a system anomaly according to the fused features. The application aims to solve the problem that the existing KPI anomaly detection method is difficult to uniformly process the heterogeneity of continuous and discrete features, and improve the detection accuracy and robustness of device system anomaly detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of device system anomaly detection, and particularly relates to a device system anomaly detection method and system based on double-path adaptive learning. BACKGROUND

[0002] With the increasing scale and complexity of modern software systems and high-performance computing environments, system reliability management faces severe challenges. KPIs, as the core indicators of system health status, their anomaly detection is crucial to ensure the stable operation of the system. KPI data usually contains two types of heterogeneous features: continuous features present periodic, trend and other smooth patterns, and discrete features show mutation, step and other local anomalies. Existing methods have significant limitations in dealing with such heterogeneous features: methods based on recurrent neural networks or Transformers are good at capturing long-term dependencies, but are difficult to respond sensitively to discrete mutations; convolution methods can capture local features, but are prone to ignore global periodic patterns; unified processing architecture often blurs the feature differences, resulting in decreased representation ability and limited detection accuracy. Therefore, an anomaly detection method that can model continuous and discrete features separately and realize cross-domain adaptive fusion is urgently needed to improve the anomaly perception ability of complex KPI data. SUMMARY

[0003] The technical problem solved by the present application: In view of the above problems of the prior art, the present application provides a device system anomaly detection method and system based on double-path adaptive learning, which aims to solve the problem that existing KPI anomaly detection methods are difficult to uniformly process the heterogeneity of continuous and discrete features, and to improve the detection accuracy and robustness of device system anomaly detection.

[0004] To solve the above technical problems, the technical scheme adopted by the present application is:

[0005] A device system anomaly detection method based on double-path adaptive learning, comprising the following steps:

[0006] S101, obtaining the input feature matrix of the device , the input feature matrix is divided into continuous feature input and discrete feature input after dimension reduction, normalization, value embedding and position embedding in turn.

[0007] S102, performing continuous feature extraction path on the continuous feature input to obtain continuous path output , performing discrete feature extraction path on the discrete feature input to obtain discrete path output .

[0008] S103, output the continuous path and the discrete path perform perceptual attention fusion to obtain a fusion feature;

[0009] S104, detect whether a system anomaly exists in the device according to the fusion feature.

[0010] Optionally, step S101 comprises:

[0011] S201, obtain an input feature matrix of a device , the size of the input feature matrix , is a batch size, is a sequence length, is an original feature dimension;

[0012] S202, dimension reduction is performed on the input feature matrix to obtain a dimension-reduced feature matrix , the size of the feature matrix , is a dimension-reduced feature dimension;

[0013] S203, min-max normalization is applied to all features in the feature matrix to linearly transform to the range of [0, 1];

[0014] S204, value embedding and position embedding are performed on the normalized feature matrix, and the normalized feature matrix is then divided into a continuous feature input and a discrete feature input , the size of the continuous feature input , the size of the discrete feature input , and are feature dimensions in the continuous feature input and the discrete feature input respectively, and and are the sum of the dimension-reduced feature dimension .

[0015] Optionally, the dimension reduction performed on the input feature matrix in step S202 to obtain the dimension-reduced feature matrix comprises:

[0016] S301, a Pearson correlation coefficient matrix is calculated for the input feature matrix , the Pearson correlation coefficient matrix​​​​ The size is Pearson correlation coefficient matrix The elements in the table represent the Pearson correlation coefficients between feature pairs.

[0017] S302, Extract the Pearson correlation coefficient matrix The Pearson correlation coefficient is greater than the preset threshold. Feature pairs are considered as strongly correlated feature pairs. Strongly correlated features are clustered into homogeneous groups, with the number of clusters being [number missing]. ;

[0018] S303: In each homogeneous group, select the feature with the highest average absolute correlation as the group representative, thus obtaining the dimensionality-reduced feature matrix composed of all group representatives. .

[0019] Optionally, in step S102, the continuous feature input... Perform continuous feature extraction paths to obtain continuous path output. include:

[0020] S401, for continuous feature input The frequency amplitude vector is extracted using Fast Fourier Transform analysis:

[0021] ;

[0022] in, It is the frequency amplitude vector. For continuous feature input Feature dimensions in For a one-dimensional fast Fourier transform along the time dimension, To intercept The c-th column of all rows;

[0023] S402, extract the K dominant frequency components with the highest amplitude from the frequency amplitude vector according to the following formula:

[0024] ;

[0025] in, ~ The 1st to the highest amplitude One dominant frequency component, The selection operation for choosing the first K parameters is used within a given range. Internal selection amplitude highest One dominant frequency component; The first frequency amplitude vector Amplitude at a frequency, For sequence length, for each dominant frequency component, the continuous feature input is down-sampled according to the following formula down-sampling; for each dominant frequency component, the continuous feature input is down-sampled according to the following formula Reshaping from one-dimensional sequence to two-dimensional tensor

[0026]

[0027] wherein, is the reshaping operation, is the zero-padding operation at the end of the sequence, is the i-th dominant frequency component, dimension represents the number of periods; S403, the two-dimensional tensor

[0028] is extracted by using a multi-branch convolution module to obtain a two-dimensional feature ;

[0029] S404, the two-dimensional feature is recovered to one-dimensional space and the filled part is truncated according to the following formula:

[0030] ;

[0031] wherein, is the feature after being recovered to one-dimensional space and the filled part is truncated, is the truncation operation, is the batch size, is the feature dimension in the continuous feature input , and is the sequence length;

[0032] S405, each dominant frequency component is recovered to one-dimensional space and the filled part is truncated is obtained by adaptive fusion through frequency amplitude weighting according to the following formula: :

[0033] ;

[0034] wherein, is the softmax activation function, is the dominant frequency component with index i in the frequency amplitude vector.

[0035] Optionally, the discrete feature extraction path is performed on the discrete feature input in step S102 to obtain a discrete path output , including:

[0036] S501, the discrete feature input ​​​​Discrete feature inputs are adjusted to a convolution-compatible format through dimension permutation. ;

[0037] S502, input discrete features in a convolution-compatible format. Feature extraction is performed using two layers of one-dimensional convolution;

[0038] S503, features extracted from two layers of one-dimensional convolution. Discrete feature input in convolution-compatible format Residual features are extracted using an adaptive residual connection mechanism. ;

[0039] S504, residual characteristics The discrete path output is obtained by sequentially performing dimension restoration and layer normalization. .

[0040] Optionally, in step S103, the continuous path is output. and discrete path output Perceptual attention fusion to obtain fused features includes:

[0041] S601 will output the continuous path. Employing a dual cross-attention interaction mechanism and discrete path output Implement bidirectional feature communication to extract continuous attention features Output discrete paths Employing a dual cross-attention interaction mechanism and continuous path output Implementing bidirectional feature communication to extract discrete attention features ;

[0042] S602, continuous attention features and discrete attention features A feature-aware gating mechanism is used to dynamically modulate the contributions of each path based on cross-domain compatibility to generate preliminary fused features. :

[0043] ;

[0044] ;

[0045] in, Features extracted by the feature-aware gating mechanism It is the sigmoid activation function. The weight matrix is ​​a learnable matrix. Features of continuous attention and discrete attention features splicing, For element-wise multiplication;

[0046] S603 will initially integrate features The refined fused features are obtained by refining the fused features through a feedforward network with residual connections to enhance the nonlinear representation capability. The functional expression of the feedforward network with residual connections is as follows:

[0047] ;

[0048] ;

[0049] in, The characteristics of the refined fusion For layer normalization, For feedforward network The output characteristics, It is a feedforward network. For GELU activation function, and This is a learnable weight matrix.

[0050] Optionally, step S104, in determining whether the fusion feature detection device has a system anomaly, includes calculating the input feature matrix of the first time step within the time window of the current time step. The difference between the fused features is used as the anomaly score. If the anomaly score exceeds a preset threshold, it is determined that there is an anomaly in the current time step of the device; otherwise, it is determined that there is no anomaly in the current time step of the device.

[0051] The present invention also provides a device system anomaly detection system based on dual-path adaptive learning, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning.

[0052] The present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning by a processor.

[0053] The present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning via a processor.

[0054] Compared with existing technologies, the present invention mainly achieves the following beneficial effects: The method of the present invention includes obtaining the input feature matrix of the device, dividing the input feature matrix into continuous feature input and discrete feature input after sequentially performing dimensionality reduction, normalization, value embedding and position embedding; performing continuous feature extraction path on the continuous feature input to obtain continuous path output, and performing discrete feature extraction path on the discrete feature input to obtain discrete path output; performing perceptual attention fusion on the continuous path output and discrete path output to obtain fused features; detecting whether the device has system anomalies based on the fused features. The device system anomaly detection method of the present invention, based on dual-path adaptive learning, through unsupervised KPI anomaly detection based on dual-path feature adaptive network, solves the problem that existing KPI anomaly detection methods are difficult to uniformly handle the heterogeneity of continuous and discrete features by separating the processing path and dynamic feature fusion, and significantly improves detection accuracy and robustness. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.

[0056] Figure 2 This is a schematic diagram illustrating the feature preprocessing principle of the dual-path feature adaptive network in an embodiment of the present invention.

[0057] Figure 3 This is a schematic diagram illustrating the principle of dual-path feature processing and feature-aware attention fusion in the dual-path feature adaptive network of this invention. Detailed Implementation

[0058] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0059] like Figure 1 As shown, the device system anomaly detection method based on dual-path adaptive learning in this embodiment includes the following steps:

[0060] S101, Obtain the input feature matrix of the device. , input feature matrix After sequential dimensionality reduction, normalization, value embedding, and position embedding, the input is segmented into continuous features. and discrete feature input ;

[0061] S102, for continuous feature input Perform continuous feature extraction paths to obtain continuous path output. For discrete feature input Perform discrete feature extraction paths to obtain discrete path outputs. ;

[0062] S103 will output the continuous path. and discrete path output Perform perceptual attention fusion to obtain fused features;

[0063] S104, Detect whether the equipment has system abnormalities based on the fusion characteristics.

[0064] Steps S101 to S103 in this embodiment constitute the input feature matrix for the slave device. A dual-path feature adaptive network (DPFAN) is used to extract fused features. It should be noted that this embodiment is applicable to various engineering or computer equipment. Since step S101 includes feature dimensionality reduction (selection), all feature data of the device can be directly input to achieve adaptive input. For different devices, it is only necessary to retrain the dual-path feature adaptive network (DPFAN) using the corresponding data.

[0065] like Figure 2 As shown, step S101 in this embodiment includes:

[0066] S201, Obtain the input feature matrix of the device. Input feature matrix The size is , For batch size, For sequence length, The original feature dimension is used as an example; as an optional implementation, the device in this embodiment is a web application server device, and the input feature matrix is... The original feature dimensions are 7, including CPU utilization, memory usage, network throughput, disk I / O rate, HTTP request success rate, HTTP error rate, and service response latency.

[0067] S202, for the input feature matrix Dimensionality reduction is performed to obtain the dimensionality-reduced feature matrix. , characteristic matrix The size is , The feature dimension after dimensionality reduction;

[0068] S203, regarding the characteristic matrix All features are subjected to min-max normalization to linearly transform to the range [0,1].

[0069] S204, the normalized feature matrix is ​​then subjected to value embedding and position embedding, and then segmented into continuous feature inputs. and discrete feature input Continuous feature input The size is Discrete feature input The size is , and Continuous feature inputs and discrete feature input The feature dimensions in, and and The sum of the two is the feature dimension after dimensionality reduction. .

[0070] In step S202 of this embodiment, the input feature matrix is... Dimensionality reduction is performed to obtain the dimensionality-reduced feature matrix. include:

[0071] S301, using a PCC (Pearson correlation coefficient matrix) filter on the input feature matrix Calculate the Pearson correlation coefficient matrix Pearson correlation coefficient matrix The size is Pearson correlation coefficient matrix The elements in the table represent the Pearson correlation coefficients between feature pairs.

[0072] S302, Extract the Pearson correlation coefficient matrix The Pearson correlation coefficient is greater than the preset threshold. (The value can be chosen according to actual needs. For example, as an optional implementation, the value in this embodiment is [value].) Feature pairs of ) are considered as strongly correlated feature pairs, and strongly correlated features are clustered into homogeneous groups, with the number of clusters being . ;

[0073] S303: In each homogeneous group, the feature with the highest mean absolute correlation (MAC) is selected as the group representative, thus obtaining the dimensionality-reduced feature matrix composed of all group representatives. . ,in , This represents the feature dimension after dimensionality reduction, i.e., the number of features retained after selection.

[0074] In step S203 of this embodiment, the minimum-maximum normalization is performed using an existing method, and its function expression is:

[0075] ;

[0076] in, To select features The normalization result, and To select features The minimum and maximum values. The function expressions for value embedding and position embedding of the normalized feature matrix in step S204 are:

[0077] ;

[0078] in, The features obtained after value embedding and position embedding, The result of the value embedding operation is the value embedding operation using... kernel size k A one-dimensional convolutional layer with a value of 3 For the positional embedding result, a positional encoding generated using a sinusoidal function is used to assign a unique representation to each position in the sequence, thus conveying the order of elements in the sequence. Finally, the features obtained after value embedding and positional embedding are combined. Further segmentation into continuous feature inputs and discrete feature input , (Continuous) and (Discrete), and Feature segmentation is part of the input design, while positional encoding provides location information to assist the Dual Path Feature Adaptive Network (DPFAN) in recognizing and utilizing pre-arranged feature segments in subsequent processing (such as attention calculation). This enhances the DPFAN's ability to perceive such segmentation structures, and this combination enables the DPFAN to process heterogeneous features more effectively.

[0079] like Figure 3 As shown, in step S102 of this embodiment, continuous feature input... Perform continuous feature extraction paths to obtain continuous path output. include:

[0080] S401, for continuous feature input The frequency amplitude vector is extracted using Fast Fourier Transform analysis:

[0081] ;

[0082] in, It is the frequency amplitude vector. , For continuous feature input Feature dimensions in This is a one-dimensional fast Fourier transform along the time dimension (to extract the frequency domain characteristics of the time series). To intercept The c-th column of all rows;

[0083] S402, extract the K dominant frequency components with the highest amplitude from the frequency amplitude vector according to the following formula:

[0084] ;

[0085] in, ~ The 1st to the highest amplitude One dominant frequency component, The topK operation is a selection operation that chooses the top K parameters, used to select from a given range. Internal selection amplitude highest One dominant frequency component; The first frequency amplitude vector Amplitude at a frequency, For sequence length, To Round down; for each dominant frequency component, input the continuous feature according to the following formula. Reconstructing a one-dimensional sequence into a two-dimensional tensor :

[0086] ;

[0087] in, For reshaping operation, Padding the end of the sequence with zeros ensures that the length can be determined. Divisible For the first One dominant frequency component, Dimension represents the number of periods;

[0088] S403, two-dimensional tensor Multi-branch convolutional modules are used for feature extraction to obtain two-dimensional features. The function expression for the multi-branch convolution module (Inception module) is as follows:

[0089] ;

[0090] in, For the Inception module, For a two-dimensional convolution with a kernel size of 2m+1, where m is the branch index in the multi-branch convolution module, used to generate convolution kernels of different scales, m=1,2,…,M. Therefore, the convolution kernel sizes of each branch of the multi-branch convolution module are 1, 3, 5, 7, etc.

[0091] S404, two-dimensional features Restore the space to one dimension and truncate the filled portion according to the following formula:

[0092] ;

[0093] in, To restore the features to one-dimensional space and truncate the filled portion, For truncation operation, For batch size, For continuous feature input Feature dimensions in The sequence length;

[0094] S405, recovers the features from each dominant frequency component to one-dimensional space and truncates the filled portion. The continuous path output is obtained through adaptive fusion with frequency amplitude weighting according to the following formula. :

[0095] ;

[0096] in, The softmax activation function is used. For the frequency amplitude vector, The dominant frequency component of the index, connected through the residual in the output, can effectively enhance the gradient flow.

[0097] like Figure 3 As shown, in step S102 of this embodiment, discrete feature input is performed. Perform discrete feature extraction paths to obtain discrete path outputs. include:

[0098] S501, Input discrete features Discrete feature inputs are adjusted to a convolution-compatible format through dimension permutation. For a given discrete feature input Adjusting the input to a convolution-compatible format through dimension permutation can be represented as:

[0099] ;

[0100] in, This is a dimension permutation operation used to input discrete features. Dimension becomes ;

[0101] S502, input discrete features in a convolution-compatible format. Feature extraction is performed using two layers of one-dimensional convolution. The function expression for feature extraction using two layers of one-dimensional convolution is as follows:

[0102] ;

[0103] ;

[0104] in, The output features of the first one-dimensional convolution, This is the output feature of the second one-dimensional convolution (i.e., the feature extracted by two one-dimensional convolutions). The kernel size is One-dimensional convolution; where the kernel size is... ( The lengths of the input and output sequences are fixed and the same padding strategy (padding='same') is used to ensure that the lengths are consistent. This design avoids the temporal resolution loss caused by pooling operations and is suitable for modeling discrete events requiring high temporal accuracy; such as Figure 3 As shown, this embodiment also includes a dropout layer between the two one-dimensional convolutional layers.

[0105] S503, features extracted from two layers of one-dimensional convolution. Discrete feature input in convolution-compatible format Residual features are extracted using an adaptive residual connection mechanism. To alleviate the vanishing gradient problem in deep network training, this embodiment introduces an adaptive residual connection mechanism for this path, the function of which is:

[0106] ;

[0107] in, Operations to obtain the dimension of a tensor The kernel size is ( One-dimensional convolution; when the input and output dimensions do not match, use... Convolution performs dimensional projection to achieve residual addition;

[0108] S504, residual characteristics The discrete path output is obtained by sequentially performing dimension restoration and layer normalization. , can be represented as:

[0109] ;

[0110] in, For layer normalization, For dimensional recovery operations.

[0111] like Figure 3 As shown, in step S103 of this embodiment, the continuous path is output. and discrete path output Perceptual attention fusion to obtain fused features includes:

[0112] S601 will output the continuous path. Employing a dual cross-attention interaction mechanism and discrete path output Implement bidirectional feature communication to extract continuous attention features Output discrete paths Employing a dual cross-attention interaction mechanism and continuous path output Implementing bidirectional feature communication to extract discrete attention features Output for a given continuous path and discrete path output The fusion process begins with a dual-cross attention interaction mechanism to achieve bidirectional feature communication, which can be represented as:

[0113] ;

[0114] ;

[0115] in, This is a multi-head attention mechanism. Here, discrete features are used as queries, and continuous features are used as keys / values ​​in the first attention calculation, and vice versa in the second. This bidirectional design ensures that both feature types can contribute to the other's contextual understanding.

[0116] S602, continuous attention features and discrete attention features A feature-aware gating mechanism is used to dynamically modulate the contributions of each path based on cross-domain compatibility to generate preliminary fused features. :

[0117] ;

[0118] ;

[0119] in, Features extracted by the feature-aware gating mechanism It is the sigmoid activation function. The weight matrix is ​​a learnable matrix. Features of continuous attention and discrete attention features splicing, This is an element-wise multiplication mechanism; this gating mechanism enables the model to adaptively emphasize information-rich features while suppressing less relevant features.

[0120] S603 will initially integrate features The refined fused features are obtained by refining the fused features through a feedforward network with residual connections to enhance the nonlinear representation capability. The functional expression of the feedforward network with residual connections is as follows:

[0121] ;

[0122] ;

[0123] in, The characteristics of the refined fusion For layer normalization, For feedforward network The output characteristics, It is a feedforward network. For GELU activation function, and This is a learnable weight matrix.

[0124] In this embodiment, the dual-path feature adaptive network learns to reconstruct normal training samples by minimizing the mean squared error (MSE) between the input and output sequences during training.

[0125] ;

[0126] in, This is the loss function used during training of the dual-path feature adaptive network. For the sample size, and The first Input feature matrix of each sample and fusion features .

[0127] like Figure 3 As shown, in step S104 of this embodiment, the method for determining whether the fusion feature detection device has a system anomaly can be adopted as needed, such as using a classifier and threshold judgment method. As an optional implementation, step S104 in this embodiment, determining whether the fusion feature detection device has a system anomaly, includes calculating the input feature matrix of the first time step within the time window of the current time step. The difference between the fused features and the anomaly score is used as the anomaly score:

[0128] ;

[0129] in, These are abnormal scores. For the current time step The input feature matrix of the first time step within the given time window , For the current time step Fusion features of the first time step within the time window If the abnormal score exceeds the preset threshold If the F1 score is positive, the device is considered to have an anomaly at its current time step; otherwise, it is considered to have no anomaly at its current time step. The optimal threshold can be determined by maximizing the F1 score. This improves the accuracy of detecting system anomalies based on fused features. Maximizing the F1 score involves iterating through all possible thresholds on an independent validation set, calculating the F1 score for each threshold, and finally selecting the threshold that maximizes the F1 score as the final decision criterion.

[0130] To validate the Dual-Path Feature Adaptive Network (DPFAN) in the device system anomaly detection method based on dual-path adaptive learning in this embodiment, this experiment evaluates it on three real-world KPI anomaly detection benchmark datasets, including two public datasets: the SMAP dataset from NASA; and the PSM dataset providing multidimensional resource utilization metrics from a large web service. All datasets are preprocessed using a sliding window method (window length = 100, stride = 1) and divided into training, validation, and test sets in a 7:1.5:1.5 ratio. For comprehensive performance comparison, this experiment selects seven state-of-the-art anomaly detection methods as baselines: Transformer-based TranAD, KPI-stream-oriented ensemble detection framework COUTA, Deep Isolation Forest-based algorithm DIF, the classic deep single-class classification method DeepSVDD, the lightweight time-series anomaly detection baseline FITS, the continuous anomaly detection method NCAD based on convolutional autoencoders, and the frequency-periodic modeling baseline TimesNet. The evaluation uses the F1 score as the core metric and follows a point adjustment strategy for fair comparison. In the implementation of the Dual Path Feature Adaptive Network (DPFAN), the following parameter settings and training strategies were adopted in this embodiment: the sliding window size was set to 100, and the stride was 1; the model was trained for a total of 10 epochs; all experiments were run in a PyTorch 3.11 environment using an NVIDIA GeForce RTX 4090 GPU (24GB); all seven benchmark models were implemented according to the method described in their original paper. Finally, the comparative experimental results are shown in Table 1.

[0131]

[0132] As shown in Table 1, the Dual-Path Feature Adaptive Network (DPFAN) in this embodiment achieves an average F1 score of 85.51, outperforming all comparative methods on both the SMAP and PSM datasets. The DPFAN in this embodiment maintains consistent performance across all datasets, while the comparative methods exhibit significant fluctuations; for example, DIF shows a 20.11% performance drop on SMAP. Therefore, the DPFAN in this embodiment demonstrates excellent anomaly detection capabilities on benchmark datasets.

[0133] Furthermore, this embodiment also provides a device system anomaly detection system based on dual-path adaptive learning, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning. This embodiment also provides a computer-readable storage medium storing a computer program or instructions programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning via a processor. This embodiment also provides a computer program product including a computer program or instructions programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning via a processor.

[0134] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0135] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A device system anomaly detection method based on dual-path adaptive learning, characterized in that, Includes the following steps: S101, Obtain the input feature matrix of the device. , input feature matrix After sequential dimensionality reduction, normalization, value embedding, and position embedding, the input is segmented into continuous features. and discrete feature input ; S102, for continuous feature input Perform continuous feature extraction paths to obtain continuous path output. For discrete feature input Perform discrete feature extraction paths to obtain discrete path outputs. ; S103 will output the continuous path. and discrete path output Perform perceptual attention fusion to obtain fused features; S104, Detect whether the equipment has system abnormalities based on the fusion features; In step S102, continuous feature inputs are processed. Perform continuous feature extraction paths to obtain continuous path output. include: S401, for continuous feature input The frequency amplitude vector is extracted using Fast Fourier Transform analysis: ； in, For frequency amplitude vector, For continuous feature input Feature dimensions in For a one-dimensional fast Fourier transform along the time dimension, To intercept The c-th column of all rows; S402, extract the K dominant frequency components with the highest amplitude from the frequency amplitude vector according to the following formula: ； in, ~ The 1st to the highest amplitude One dominant frequency component, The selection operation for choosing the first K parameters is used within a given range. Internal selection amplitude highest One dominant frequency component; The first frequency amplitude vector Amplitude at a frequency, For sequence length, To Round down; for each dominant frequency component, input the continuous feature according to the following formula. Reconstructing a one-dimensional sequence into a two-dimensional tensor : ； in, For reshaping operation, To pad the end of a sequence with zeros, For the first One dominant frequency component, Dimension represents the number of periods; S403, two-dimensional tensor Multi-branch convolutional modules are used for feature extraction to obtain two-dimensional features. ; S404, two-dimensional features Restore the space to one dimension and truncate the filled portion according to the following formula: ； in, To restore the features to one-dimensional space and truncate the filled portion, For truncation operation, For batch size, For continuous feature input Feature dimensions in The sequence length; S405, recovers the features from each dominant frequency component to one-dimensional space and truncates the filled portion. The continuous path output is obtained through adaptive fusion with frequency amplitude weighting according to the following formula. : ； in, The softmax activation function is used. In the frequency amplitude vector, The dominant frequency component of the index; In step S102, the discrete feature input is... Perform discrete feature extraction paths to obtain discrete path outputs. include: S501, Input discrete features Discrete feature inputs are adjusted to a convolution-compatible format through dimension permutation. ; S502, input discrete features in a convolution-compatible format. Feature extraction is performed using two layers of one-dimensional convolution; S503, features extracted from two layers of one-dimensional convolution. Discrete feature input in convolution-compatible format Residual features are extracted using an adaptive residual connection mechanism. ; S504, residual characteristics The discrete path output is obtained by sequentially performing dimension restoration and layer normalization. .

2. The device system anomaly detection method based on dual-path adaptive learning according to claim 1, characterized in that, Step S101 includes: S201, Obtain the input feature matrix of the device. Input feature matrix The size is , For batch size, For sequence length, The original feature dimension; S202, for the input feature matrix Dimensionality reduction is performed to obtain the dimensionality-reduced feature matrix. , characteristic matrix The size is , The feature dimension after dimensionality reduction; S203, regarding the characteristic matrix All features are subjected to min-max normalization to linearly transform to the range [0,1]. S204, the normalized feature matrix is ​​then subjected to value embedding and position embedding, and then segmented into continuous feature inputs. and discrete feature input Continuous feature input The size is Discrete feature input The size is , and Continuous feature inputs and discrete feature input The feature dimensions in, and and The sum of the two is the feature dimension after dimensionality reduction. .

3. The device system anomaly detection method based on dual-path adaptive learning according to claim 2, characterized in that, In step S202, the input feature matrix is ​​processed. Dimensionality reduction is performed to obtain the dimensionality-reduced feature matrix. include: S301, for the input feature matrix Calculate the Pearson correlation coefficient matrix Pearson correlation coefficient matrix The size is Pearson correlation coefficient matrix The elements in the table represent the Pearson correlation coefficients between feature pairs. S302, Extract the Pearson correlation coefficient matrix The Pearson correlation coefficient is greater than the preset threshold. Feature pairs are considered as strongly correlated feature pairs. Strongly correlated features are clustered into homogeneous groups, with the number of clusters being [number missing]. ; S303: In each homogeneous group, select the feature with the highest average absolute correlation as the group representative, thus obtaining the dimensionality-reduced feature matrix composed of all group representatives. .

4. The device system anomaly detection method based on dual-path adaptive learning according to claim 1, characterized in that, In step S103, the continuous path is output. and discrete path output Perceptual attention fusion to obtain fused features includes: S601 will output the continuous path. Employing a dual cross-attention interaction mechanism and discrete path output Implement bidirectional feature communication to extract continuous attention features Output discrete paths Employing a dual cross-attention interaction mechanism and continuous path output Implementing bidirectional feature communication to extract discrete attention features ; S602, continuous attention features and discrete attention features A feature-aware gating mechanism is used to dynamically modulate the contributions of each path based on cross-domain compatibility to generate preliminary fused features. : ； ； in, Features extracted by the feature-aware gating mechanism It is the sigmoid activation function. The weight matrix is ​​a learnable matrix. Features of continuous attention and discrete attention features splicing, For element-wise multiplication; S603 will initially integrate features The refined fused features are obtained by refining the fused features through a feedforward network with residual connections to enhance the nonlinear representation capability. The functional expression of the feedforward network with residual connections is as follows: ； ； in, The characteristics of the refined fusion For layer normalization, For feedforward network The output characteristics, It is a feedforward network. For GELU activation function, and This is a learnable weight matrix.

5. The device system anomaly detection method based on dual-path adaptive learning according to claim 1, characterized in that, Step S104 involves detecting whether the fusion feature detection device has system anomalies, including calculating the input feature matrix of the first time step within the time window of the current time step. The difference between the fused features is used as the anomaly score. If the anomaly score exceeds a preset threshold, it is determined that there is an anomaly in the current time step of the device; otherwise, it is determined that there is no anomaly in the current time step of the device.

6. A device system anomaly detection system based on dual-path adaptive learning, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to execute the device system anomaly detection method based on dual-path adaptive learning as described in any one of claims 1 to 5.

7. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the device system anomaly detection method based on dual-path adaptive learning as described in any one of claims 1 to 5.

8. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the device system anomaly detection method based on dual-path adaptive learning as described in any one of claims 1 to 5.

Images