Monitoring data analysis method and system based on neural network

Abstract

The invention discloses a monitoring data analysis method and system based on a neural network, and relates to the technical field of monitoring data analysis, and the method comprises the steps: obtaining original monitoring data collected by a plurality of monitoring nodes in a continuous time interval, carrying out the slicing of the original monitoring data according to a preset time window, and constructing a space-time input tensor; inputting the space-time input tensor into a gated multi-head space-time attention encoder, generating a high-level space-time representation through a dynamic gating mechanism, and extracting a local abnormal value corresponding to the monitoring node from the high-level space-time representation; performing normalization processing on the local abnormal value to form spatial abnormal distribution, and calculating a spatial abnormal entropy based on the spatial abnormal distribution; the spatial anomaly entropy represents the dispersion degree of the anomaly response among the monitoring nodes; performing space-time pooling on the high-level space-time representation to obtain a global semantic representation vector; by constructing a gated multi-head space-time attention encoder, precise modeling of a space-time dependency relationship in monitoring data is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of monitoring data analysis, in particular to a monitoring data analysis method and system based on a neural network. BACKGROUND

[0002] The monitoring data analysis technology refers to a technical system for automatically processing, feature extraction, pattern modeling and anomaly identification of raw data collected by a plurality of monitoring nodes distributed in a physical space within a continuous time interval. Therefore, how to use advanced technical means to improve the intelligent level and security of the monitoring data analysis technology has become one of the problems to be solved at present.

[0003] In the field of monitoring data analysis, the existing method generally regards the whole system as a whole, only calculates a global anomaly score, and when a single sensor produces a high response due to noise, drift or temporary interference, it is misjudged as a system-level anomaly, which cannot distinguish between isolated point disturbance and multi-node coordinated anomaly, resulting in a large number of false alarms, reducing the credibility of the system, and the traditional threshold setting relies on artificial experience or static percentile, without dynamic adjustment combined with the spatial structure information of the current anomaly. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a monitoring data analysis method based on a neural network to solve the problem that the existing method generally regards the whole system as a whole, only calculates a global anomaly score, and when a single sensor produces a high response due to noise, drift or temporary interference, it is misjudged as a system-level anomaly, which cannot distinguish between isolated point disturbance and multi-node coordinated anomaly, resulting in a large number of false alarms, reducing the credibility of the system, and the traditional threshold setting relies on artificial experience or static percentile, without dynamic adjustment combined with the spatial structure information of the current anomaly.

[0006] To solve the above technical problems, the present application provides the following technical solutions: In a first aspect, the present application provides a monitoring data analysis method based on a neural network, comprising: obtaining raw monitoring data collected by a plurality of monitoring nodes within a continuous time interval, and slicing the raw monitoring data according to a preset time window to construct a spatio-temporal input tensor; inputting the spatio-temporal input tensor into a gated multi-head spatio-temporal attention encoder to generate high-level spatio-temporal representations through a dynamic gating mechanism, and extracting local anomaly values corresponding to the monitoring nodes from the high-level spatio-temporal representations; normalizing the local anomaly values to form a spatial anomaly distribution, and calculating a spatial anomaly entropy based on the spatial anomaly distribution; the spatial anomaly entropy represents the dispersion degree of abnormal responses among the monitoring nodes; pooling the high-level spatio-temporal representation to obtain a global semantic representation vector; defining a normal behavior prototype library initially empty, comparing the global semantic representation vector of the current time window with the stored representation in the normal behavior prototype library in semantic similarity, obtaining a global anomaly score; based on the sliding statistical value of the historical anomaly score and the spatial anomaly entropy, generating an alarm threshold for the current time window; When the global anomaly score exceeds the alarm threshold and the spatial anomaly entropy is lower than the preset threshold, an abnormal alarm is triggered, otherwise, the current global semantic representation vector is stored in the normal behavior prototype library, and the normal behavior mode is updated.

[0007] As a preferred scheme of the neural network-based monitoring data analysis method, wherein: the spatio-temporal input tensor is input into the gated multi-head spatio-temporal attention encoder to generate a high-level spatio-temporal representation, and the local anomaly value corresponding to the monitoring node is extracted from the high-level spatio-temporal representation, and the specific steps are as follows: acquire the spatio-temporal input tensor collected by multiple monitoring nodes in a continuous time interval and sliced according to a preset time window, denoted as ; input into the gated multi-head spatio-temporal attention encoder, the gated multi-head spatio-temporal attention encoder includes multiple parallel attention heads; for any attention head, the linear transformation is performed on the by a learnable weight matrix to obtain a query matrix, a key matrix and a value matrix; the global context vector is obtained by performing global average pooling on the along the time dimension and the space dimension; the global context vector is input into a lightweight fully connected layer and then activated by a Sigmoid function to generate a gating coefficient vector; the gating coefficient vector is multiplied by the query matrix and the key matrix to obtain the gated query matrix and the gated key matrix; the attention weight is calculated using the gated query matrix and the gated key matrix, and the value matrix is weighted and summed to obtain the output of the attention head; the outputs of all attention heads are concatenated and linearly projected to form a high-level spatio-temporal representation ; ; for each monitoring node , the feature sub-tensor of its corresponding spatial position at all time steps is extracted from , and the L2 norm of the sub-tensor is calculated as the local anomaly value .

[0008] As a preferred embodiment of the neural network-based monitoring data analysis method of the present invention, the steps of normalizing local outliers to form a spatial anomaly distribution and calculating the spatial anomaly entropy based on the spatial anomaly distribution are as follows: Collect local outliers from all monitored nodes to form a vector. ; right The spatial anomaly distribution is obtained by applying the Softmax function for normalization. , of which Each component The calculation formula is: ; in, Indicates the first Local outliers of individual monitoring nodes This indicates the total number of monitoring nodes. Represents the natural exponential function; An information entropy-based quantization mechanism is introduced to transform discrete local outliers into a measurable spatial probability structure, based on the spatial anomaly distribution. Calculate the spatial anomaly entropy The expression is: ; in, Represents the spatial anomaly distribution of the th The probability weights of each monitoring node. This represents a logarithmic function with the natural constant as its base. The smaller the value, the more spatially concentrated the abnormal response.

[0009] As a preferred embodiment of the neural network-based monitoring data analysis method of the present invention, the following steps are taken: First, a normal behavior prototype library is defined initially as empty. Then, the global semantic representation vector of the current time window is semantically compared with the representations already stored in the normal behavior prototype library to obtain a global anomaly score. High-level spatiotemporal representation Perform average pooling along the time and space dimensions to obtain the global semantic representation vector. ; Initialize an empty set as a prototype library for normal behavior. ; like When not empty, each of the prototype vectors contained therein is denoted as follows: ,in , indicating the first One prototype vector, Represents a set Total number of elements, i.e. the number of normal behavior prototypes currently stored; Calculate the cosine similarity of , take the maximum value of all cosine similarities, denoted as ; Introduce an anomaly score mechanism based on the maximum similarity complement, and calculate the global anomaly score according to , realize the semantic level deviation quantification of the current state and the historical normal mode, the expression is: ; Wherein, , represents the global semantic feature vector of the current time window, represents the first prototype vector in the normal behavior prototype library ; If is empty, skip the similarity comparison, directly store in , and set to a preset initial value.

[0010] As a preferred scheme of the neural network-based monitoring data analysis method described in the application, wherein: the sliding statistical value based on the historical anomaly score and the spatial anomaly entropy generate an alarm threshold for the current time window, and the specific steps are: Maintain a first-in-first-out queue with a length of , used to store the global anomaly scores of the last time windows; Whenever a new score is generated, it is added to the end of the queue, and if the queue length exceeds , the first element is removed; Calculate the arithmetic mean of all elements in the queue as the sliding statistical value of the historical anomaly score ; The adaptive adjustment strategy of the spatial anomaly entropy dynamically embedded in the historical statistics is combined with the spatial anomaly entropy of the current time window to calculate the alarm threshold of the current time window, which is used to fuse the spatial structure prior to improve the discriminant ability of the threshold, and the expression is: ; Wherein, represents the sliding average value of the historical anomaly score, represents a preset sensitivity adjustment coefficient, represents the spatial anomaly entropy of the current time window, constitute a regulatory factor positively correlated with spatial aggregation.

[0011] As a preferred scheme of the neural network-based monitoring data analysis method, the steps of storing the current global semantic representation vector into the normal behavior prototype library and updating the normal behavior mode include: adding the global semantic representation vector of the current time window to the normal behavior prototype library ; When the number of prototypes in the prototype library exceeds a preset upper limit , perform K-means clustering on all prototype vectors in the prototype library , and set the number of clusters to . In long-term operation, the compactness and representativeness of the prototype library need to be maintained. A prototype compression mechanism based on cluster centroids is introduced. For the i-th cluster, the centroid vector is calculated, which is used to retain the core semantic distribution of normal behavior and is expressed as: ; ; wherein represents a set of prototype vectors contained in the i-th cluster, represents the number of elements in the set, represents any prototype vector in the set, and represents the average representation of the cluster. Replace the original prototype library with all centroid vectors to form a compressed normal behavior prototype library. Subsequent semantic similarity comparison is based on the compressed prototype library.

[0012] As a preferred scheme of the neural network-based monitoring data analysis method, when the global anomaly score exceeds the alarm threshold and the spatial anomaly entropy is lower than the preset threshold, an abnormal alarm is triggered, otherwise, the current global semantic representation vector is stored in the normal behavior prototype library to update the normal behavior mode, wherein the preset threshold is a threshold , and satisfies , and the judgment logic includes: If both and are satisfied, an abnormal alarm is triggered. Otherwise, the current sample is determined to be normal, and is stored in . wherein ​​​Indicates the global anomaly score. This indicates the alarm threshold for the current time window. Represents spatial anomaly entropy, This indicates a preset spatial clustering threshold. This indicates the total number of monitoring nodes.

[0013] Secondly, the present invention provides a monitoring data analysis system based on a neural network, comprising: The module includes a spatiotemporal tensor construction module, a gated spatiotemporal coding module, a spatial anomaly entropy calculation module, a global semantic extraction module, a prototype library comparison module, a dynamic threshold generation module, and a dual-condition alarm decision module. The spatiotemporal tensor construction module is used to acquire raw monitoring data collected by multiple monitoring nodes within a continuous time interval, and to slice the raw monitoring data according to a preset time window to construct a spatiotemporal input tensor. The gated spatiotemporal coding module is used to input the spatiotemporal input tensor into the gated multi-head spatiotemporal attention encoder, generate a high-level spatiotemporal representation through a dynamic gating mechanism, and extract the local anomaly values ​​corresponding to each monitoring node from the high-level spatiotemporal representation. The spatial anomaly entropy calculation module is used to normalize local anomaly values ​​to form a spatial anomaly distribution, and calculate the spatial anomaly entropy based on the spatial anomaly distribution, where the spatial anomaly entropy represents the degree of dispersion of the anomaly response among monitoring nodes. The global semantic extraction module is used to pool the high-level spatiotemporal representation along the time and space dimensions to obtain a global semantic representation vector. The prototype library comparison module is used to maintain an initially empty normal behavior prototype library, and compare the global semantic representation vector of the current time window with the representations stored in the prototype library to perform semantic similarity comparison and output a global anomaly score. The dynamic threshold generation module is used to adaptively generate the alarm threshold for the current time window based on the sliding statistics of historical anomaly scores and the current spatial anomaly entropy. The dual-condition alarm decision module is used to determine whether the global anomaly score exceeds the alarm threshold and whether the spatial anomaly entropy is lower than the preset threshold. If both conditions are met, an anomaly alarm is triggered; otherwise, the current global semantic representation vector is stored in the normal behavior prototype library, and the normal behavior pattern is updated.

[0014] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein when the computer program is executed by the processor, it implements any step of the neural network-based monitoring data analysis method described in the first aspect of the present invention.

[0015] In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements any step of the neural network-based monitoring data analysis method according to the first aspect of the present application.

[0016] The present application has the following beneficial effects: by constructing a gated multi-head spatio-temporal attention encoder, the spatio-temporal dependency in the monitoring data is accurately modeled, and the local outliers of each node are extracted, the spatial anomaly entropy is introduced to quantify the aggregation degree of the anomaly in the monitoring nodes, the local disturbance and the systematic failure are effectively distinguished, at the same time, the semantic-level similarity comparison is performed based on the dynamically updated normal behavior prototype library, the global anomaly score reflecting the overall deviation degree is obtained, the alarm threshold is adaptively generated by fusing the historical anomaly statistics and the spatial anomaly entropy, and the high global anomaly score + low spatial anomaly entropy double condition joint criterion is used to trigger the alarm, which avoids the false alarm and the missed alarm caused by the isolated point noise or the extensive slight fluctuation in the traditional method, and the model compactness and representativeness under long-term operation are ensured by the prototype library clustering compression mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0018] Figure 1 The flowchart of the neural network-based monitoring data analysis method in embodiment 1.

[0019] Figure 2 The schematic diagram of the neural network-based monitoring data analysis system in embodiment 1. DETAILED DESCRIPTION

[0020] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail in conjunction with the drawings of the specification.

[0021] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the concept of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0022] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0023] Example, refer to Figure 1 and Figure 2 This embodiment of the invention provides a monitoring data analysis method based on a neural network, comprising the following steps: S1. Obtain raw monitoring data collected by multiple monitoring nodes within a continuous time interval, and slice the raw monitoring data according to a preset time window to construct a spatiotemporal input tensor.

[0024] Furthermore, the raw monitoring data is deployed in different locations in the physical space. Multiple monitoring nodes synchronously collect data, with each node continuously outputting one-dimensional or multi-dimensional sensor signals at a fixed sampling period in the time dimension. The continuous time interval is divided into sliding time windows of length W sampling points, ensuring temporal overlap or seamless connection between adjacent windows. Data within each time window is organized using the monitoring node index as the spatial dimension and the time step number as the time dimension, forming a three-dimensional tensor. This three-dimensional tensor is the spatiotemporal input tensor. It is used to characterize the complete spatiotemporal state of the monitored area within the current time window.

[0025] It should be noted that by organizing the original monitoring data into a three-dimensional spatiotemporal tensor with clear spatial node indices and time step numbers, not only are the dynamic characteristics of each monitoring point in the time evolution preserved, but the spatial relationship structure between different physical locations is also explicitly modeled. This provides a standardized and structured input basis for the subsequent neural network to model complex spatiotemporal dependencies, effectively avoiding the problem of spatiotemporal information loss caused by data flattening in traditional methods.

[0026] Specifically, this step constructs a three-dimensional spatiotemporal tensor from the raw monitoring data. The design logic stems from the understanding of the nature of anomaly propagation in the physical world. Real anomalies often have spatiotemporal continuity and spatial correlation. By explicitly preserving the node-time-feature triple structure, the destruction of spatiotemporal topology caused by traditional vectorization processing is avoided. The use of sliding window slicing not only supports streaming processing but also enhances the stability of temporal modeling through temporal overlap. The synchronous sampling mechanism ensures the temporal alignment of the states of each node in the spatial dimension. The structured input provides the neural network with a learnable spatiotemporal inductive bias, enabling the model to naturally distinguish between local noise and systemic events.

[0027] S2, input the spatio-temporal input tensor into a gated multi-head spatio-temporal attention encoder, generate high-level spatio-temporal representations through a dynamic gating mechanism, and extract local outliers corresponding to the monitoring nodes from the high-level spatio-temporal representations.

[0028] Further, a spatio-temporal input tensor formed by a plurality of monitoring nodes in a continuous time interval and sliced according to a preset time window is obtained, denoted as ; the is input into a gated multi-head spatio-temporal attention encoder, which includes a plurality of parallel attention heads; for any attention head, the is linearly transformed by a learnable weight matrix to obtain a query matrix, a key matrix and a value matrix; the is globally averaged pooled along the time dimension and the space dimension to obtain a global context vector; the global context vector is input into a lightweight fully connected layer and then activated by a Sigmoid function to generate a gating coefficient vector.

[0029] The gating coefficient vector is multiplied by the query matrix and the key matrix to obtain a gated query matrix and a gated key matrix; the attention weight is calculated using the gated query matrix and the gated key matrix, and the value matrix is weighted summed to obtain the output of the attention head; the outputs of all attention heads are concatenated and linearly projected to form high-level spatio-temporal representations ; for each monitoring node , a feature sub-tensor of the spatial position of the monitoring node in all time steps is extracted from , and the L2 norm of the sub-tensor is calculated as a local outlier .

[0030] It should be noted that the adopted gated multi-head spatio-temporal attention mechanism realizes adaptive modulation of the query and the key by introducing a gating coefficient dynamically generated from the global context, so that the model can selectively enhance or suppress the attention weight of a specific spatio-temporal region according to the current overall state, the design improves the sensitivity of the model to key abnormal regions, while suppressing the interference of irrelevant noise, thereby extracting more discriminative local outliers from high-level representations, laying a reliable foundation for subsequent spatial anomaly distribution analysis.

[0031] In particular, the design core of the gated multi-head spatio-temporal attention encoder is to solve the problem of attention over-generalization. Traditional multi-head attention is easily disturbed by irrelevant nodes or time steps in complex monitoring scenarios, leading to dilution of key abnormal signals. This step introduces a gating coefficient dynamically generated by global context. The underlying logic is that the overall state of the system should regulate local attention allocation. When the global state is stable, the sensitivity is suppressed to resist noise. When potential abnormal clues appear in the global state, attention to high response areas is enhanced. This gating operates on queries and keys rather than values, preserving original feature information while accurately modulating the similarity calculation process. L2 norm is used as a local outlier extraction method because it is sensitive to high-dimensional feature energy changes and computationally efficient, effectively reflecting the degree of deviation of node behavior and providing reliable input for subsequent spatial distribution modeling.

[0032] S3, normalizing the local outlier values to form a spatial anomaly distribution, and calculating a spatial anomaly entropy based on the spatial anomaly distribution; the spatial anomaly entropy representing a dispersion degree of abnormal responses among the monitoring nodes.

[0033] Further, local outlier values of all monitoring nodes are collected to form a vector ; the vector is normalized by applying a Softmax function to obtain a spatial anomaly distribution , wherein a calculation formula of an i-th component of the spatial anomaly distribution is: ; wherein, xi represents the local outlier value of the i-th monitoring node, N represents a total number of the monitoring nodes, and exp represents a natural exponential function. A quantification mechanism based on information entropy is introduced to convert discrete local outlier values into a measurable spatial probability structure. Based on the spatial anomaly distribution , a spatial anomaly entropy is calculated, and an expression is:

[0034] ; wherein, pi represents a probability weight of the i-th monitoring node in the spatial anomaly distribution, log represents a logarithmic function with a natural constant as a base, and the smaller the value is, the more concentrated the abnormal responses are in space.

[0035] ​​​​​​​​​​​It should be noted that the local outliers are converted into a spatial anomaly distribution in the form of probability by Softmax normalization, and the Shannon information entropy is further calculated, and the spatial aggregation of the anomaly is quantified as a measurable scalar index. The spatial anomaly entropy can effectively distinguish between single-point sudden disturbance and multi-point coordinated anomaly, provide key spatial structure prior for alarm decision, and reduce the false alarm rate caused by isolated sensor false alarm.

[0036] In particular, the local outliers are converted into a probability distribution and the information entropy is calculated. The design motivation comes from the need to decouple the semantic of the abnormal spatial form. A single node with high abnormal value may be a sensor fault, while multiple adjacent nodes with abnormal values may reflect a real event. Softmax normalization converts the absolute abnormal strength into a relative contribution weight, eliminating the influence of dimensional differences. Shannon entropy naturally has the property of uncertainty measurement. Low entropy corresponds to a high-deterministic spatial concentration pattern. This design does not require a pre-set spatial adjacency graph or topological relationship, and can implicitly capture spatial coordination through data-driven methods. It is superior to traditional graph neural network methods that rely on fixed graph structures, and is particularly suitable for scenarios where node positions are unknown or topologies change dynamically.

[0037] S4, performing spatio-temporal pooling on the high-level spatio-temporal representation to obtain a global semantic representation vector.

[0038] Furthermore, the high-level spatio-temporal representation is a three-dimensional tensor output by the gated multi-head spatio-temporal attention encoder; the three-dimensional tensor is first subjected to an average pooling operation along the time dimension to obtain the time-domain aggregated features of each monitoring node within the entire time window, forming a space-feature matrix; then the matrix is subjected to an average pooling along the space dimension to further fuse the time-domain aggregated features of all nodes, generating a vector with a dimension of The vector is the global semantic representation vector , each dimension of which encodes the abstract behavior pattern of the entire monitoring system in the spatio-temporal joint semantic space under the current time window, for representing whether the overall running state deviates from the historical normal behavior.

[0039] It should be noted that by performing double average pooling on the high-level spatio-temporal representation, a compression mapping from fine-grained spatio-temporal features to global semantic vectors is achieved, and the vector condenses the comprehensive behavior semantics of the entire monitoring system within the current window; compared with directly using raw data or shallow features, this global semantic representation has stronger robustness and abstraction ability, and can effectively capture subtle deviations in system-level running patterns, providing a high-quality representation basis for semantic-level comparison with historical normal prototypes.

[0040] In particular, the design of double average pooling to generate global semantic representation is based on the principle of abnormality detection that needs to balance local details and global semantics. The high-level spatiotemporal representation contains rich details, but directly using it for comparison will introduce redundant noise and high computational cost. Therefore, the time dimension is first pooled to eliminate transient jitter and extract node stable behavior features. Then, the space dimension is pooled to integrate the state of the whole network and form a global description of the system running mode. The compression process retains the semantic backbone information while greatly reducing the dimension, making the subsequent similarity calculation with the prototype library efficient and robust. Moreover, the global vector is located in a unified semantic space, making the states of different time windows comparable and laying the foundation for constructing a long-term memory normal behavior model.

[0041] S5, defining an initial empty normal behavior prototype library, comparing the global semantic representation vector of the current time window with the stored representation in the normal behavior prototype library for semantic similarity, and obtaining a global anomaly score.

[0042] Furthermore, the high-level spatiotemporal representation is pooled along the time and space dimensions to obtain the global semantic representation vector ; an empty set is initialized as the normal behavior prototype library ; if is not empty, each prototype vector contained in it is sequentially recorded as , where is the th prototype vector, is the total number of elements in the set , i.e., the number of currently stored normal behavior prototypes.

[0043] The cosine similarity between and is calculated, and the maximum value of all cosine similarities is recorded as ; an anomaly score mechanism based on the maximum similarity is introduced, and the global anomaly score is calculated according to , which realizes the semantic level deviation quantification of the current state and historical normal mode, and the expression is: ; where , is the global semantic representation vector of the current time window, is the th prototype vector in the normal behavior prototype library ; if is empty, skip the similarity comparison and store directly in , and set to a preset initial value.

[0044] It should be noted that the global anomaly score constructed based on the maximum matching mechanism of cosine similarity essentially measures the minimum semantic distance between the current state and the set of known normal behavior patterns; the method does not need to pre-set abnormal categories, has zero-sample anomaly detection capability, and through the design of complementary values, the anomaly score has a clear physical meaning and monotonicity, which is convenient for subsequent threshold judgment and system expansion, and is particularly suitable for unknown anomaly detection scenarios in open dynamic environments.

[0045] In particular, based on the maximum cosine similarity-based anomaly score mechanism, the underlying logic is the normal pattern coverage hypothesis, that is, all normal states should be approximately represented by one or more patterns in the historical prototype library; taking the maximum similarity instead of the average is to capture the closest matching prototype and avoid being pulled down by the far prototype; adopting 1- As an anomaly score, the larger the value, the more serious the deviation, which conforms to intuition and is convenient for threshold setting; the method does not need to train abnormal samples; the incremental update mechanism of the prototype library further ensures the adaptability of the model to the slow drift of the system.

[0046] S6, based on the sliding statistical value of the historical anomaly score and the spatial anomaly entropy, generate the alarm threshold of the current time window.

[0047] Further, a first-in-first-out queue with a length of is maintained to store the global anomaly scores of the last time windows; when a new score is generated, it is added to the end of the queue, and if the length of the queue exceeds , the first element of the queue is removed; the arithmetic mean of all elements in the queue is calculated as the sliding statistical value of the historical anomaly score .

[0048] The adaptive adjustment strategy of dynamically embedding the spatial anomaly entropy into the historical statistics is combined with the spatial anomaly entropy of the current time window to calculate the alarm threshold of the current time window, which is used to fuse the spatial structure prior to improve the discriminant ability of the threshold, and the expression is: ; Wherein, represents the sliding average value of the historical anomaly score, represents a preset sensitivity adjustment coefficient, represents the spatial anomaly entropy of the current time window, constitutes a positive correlation adjustment factor with spatial aggregation.

[0049] It should be noted that the sliding average of the historical anomaly score is coupled with the current spatial anomaly entropy to generate an adaptive alarm threshold, breaking the limitations of traditional fixed thresholds or relying only on statistical distribution; wherein, As a regulating factor, when the anomaly presents spatial aggregation, the alarm threshold is automatically lowered, and the sensitivity is improved; on the contrary, when the anomaly is dispersed, the threshold is raised to suppress noise interference; the mechanism realizes the intelligent response of the threshold to the spatial form of the anomaly, and enhances the adaptive discrimination ability of the system.

[0050] In particular, the design of the adaptive alarm threshold breaks through the fundamental defect that static thresholds cannot cope with dynamic changes in the environment; the alarm sensitivity should be adjusted according to the current state of the system, and the sliding average of the historical anomaly score reflects the recent baseline noise level of the system, while The spatial aggregation, a strong priori knowledge, is integrated into the threshold calculation as a regulating factor; when the anomaly is concentrated in a few areas, it is more likely to be a real event, and the threshold should be lowered to improve the detection rate; on the contrary, if the anomaly is dispersed, it is considered as noise, and the threshold is raised to suppress false alarms; The parameters provide a manual intervention interface, which can be fine-tuned according to the scene risk preference during deployment.

[0051] S7、When the global anomaly score exceeds the alarm threshold and the spatial anomaly entropy is lower than the preset threshold, an abnormal alarm is triggered, otherwise the current global semantic representation vector is stored in the normal behavior prototype library, and the normal behavior mode is updated.

[0052] Further, under the condition that the abnormal alarm is not triggered, the global semantic representation vector of the current time window is added to the normal behavior prototype library ; when the number of prototypes in exceeds the preset upper limit , K-means clustering is performed on all prototype vectors in , and the number of clustering clusters is set to .

[0053] In long-term operation, the compactness and representativeness of the prototype library need to be maintained, and a prototype compression mechanism based on cluster centroids is introduced. For the th clustering cluster, the centroid vector is calculated, which is used to retain the core semantic distribution of normal behavior, and the expression is: ; Wherein, represents the prototype vector set contained in the th clustering cluster, represents the number of elements in the set, represents any prototype vector in the set, representing the average representation of the cluster; replacing the original with all the centroid vectors , forming a compressed normal behavior prototype library; subsequent semantic similarity comparison is based on the compressed prototype library; wherein the preset threshold is the threshold , and satisfies The judgment logic includes: if the following conditions are met simultaneously and , triggering an abnormal alarm; otherwise, determining that the current sample is normal, and storing in ; wherein, represents the global anomaly score, represents the alarm threshold of the current time window, represents the spatial anomaly entropy, represents the preset spatial aggregation threshold, represents the total number of monitoring nodes.

[0054] It should be noted that the dual condition joint criterion of high global anomaly score + low spatial anomaly entropy is used to verify the authenticity of the anomaly from two dimensions of semantic deviation and spatial consistency, effectively avoiding false positives caused by a single indicator; at the same time, the normal behavior prototype library is dynamically compressed by K-means clustering, maintaining the compactness and representativeness of the library in long-term operation, preventing storage explosion, and retaining the core distribution characteristics of normal patterns, ensuring high detection performance and low resource overhead in the process of continuous learning.

[0055] In particular, the design of the dual condition alarm criterion embodies the multi-evidence cross-validation principle, which guarantees the alarm reliability from two orthogonal dimensions: a high global anomaly score indicates that the current state deviates from the historical normal mode, and a low spatial anomaly entropy indicates that the anomaly has spatial consistency. The simultaneous satisfaction of the two greatly reduces the false alarm probability; while the normal sample storage and prototype compression mechanism solves the two challenges in long-term operation, including continuous learning of new normal patterns to adapt to system evolution and preventing the prototype library from unlimited expansion leading to out-of-control computing and storage overhead; K-means clustering compression retains the core cluster structure of the normal distribution, and the centroid vector as the prototype can represent a class of normal behavior and is controllable in quantity.

[0056] The embodiment also provides a monitoring data analysis system based on a neural network, comprising: a spatiotemporal tensor construction module, a gated spatiotemporal encoding module, a spatial anomaly entropy calculation module, a global semantic extraction module, a prototype library comparison module, a dynamic threshold generation module, and a dual condition alarm decision module.

[0057] The spatio-temporal tensor construction module is configured to acquire original monitoring data collected by the plurality of monitoring nodes in a continuous time interval, and slice the original monitoring data according to a preset time window to construct a spatio-temporal input tensor.

[0058] The gated spatio-temporal encoding module is configured to input the spatio-temporal input tensor into a gated multi-head spatio-temporal attention encoder, generate high-level spatio-temporal representations through a dynamic gating mechanism, and extract local abnormal values corresponding to the monitoring nodes from the high-level spatio-temporal representations.

[0059] The spatial anomaly entropy calculation module is configured to normalize the local abnormal values to form a spatial anomaly distribution, and calculate a spatial anomaly entropy based on the spatial anomaly distribution, wherein the spatial anomaly entropy represents a dispersion degree of abnormal responses among the monitoring nodes.

[0060] The global semantic extraction module is configured to pool the high-level spatio-temporal representations along time and space dimensions to obtain a global semantic representation vector.

[0061] The prototype library comparison module is configured to maintain a normal behavior prototype library initially empty, and compare the global semantic representation vector of the current time window with the stored representations in the prototype library in terms of semantic similarity to output a global anomaly score.

[0062] The dynamic threshold generation module is configured to adaptively generate an alarm threshold of the current time window based on a sliding statistical value of historical anomaly scores and the current spatial anomaly entropy.

[0063] The dual-condition alarm decision module is configured to determine whether the global anomaly score exceeds the alarm threshold and whether the spatial anomaly entropy is lower than a preset threshold: if both conditions are met, an abnormal alarm is triggered; otherwise, the current global semantic representation vector is stored in the normal behavior prototype library to update the normal behavior mode.

[0064] The embodiment also provides a computer device suitable for the case of the monitoring data analysis method based on a neural network, which comprises a memory and a processor; the memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions to implement the monitoring data analysis method based on the neural network proposed in the above embodiment.

[0065] The computer device can be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved by WIFI, a carrier network, NFC (Near Field Communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, a trackball or a touchpad arranged on the shell of the computer device, or an external keyboard, a touchpad or a mouse, etc.

[0066] The embodiment also provides a storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the method for analyzing monitoring data based on a neural network according to the above embodiment. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0067] To sum up, by constructing a gated multi-head spatio-temporal attention encoder, the application realizes accurate modeling of the spatio-temporal dependence relationship in the monitoring data, extracts local outliers of each node from the monitoring data, introduces a spatial anomaly entropy to quantify the aggregation degree of the anomaly in the monitoring nodes, effectively distinguishes local disturbance from systematic failure, simultaneously, based on a dynamically updated normal behavior prototype library, performs semantic level similarity comparison to obtain a global anomaly score reflecting the overall deviation degree, fuses a historical anomaly statistic and the spatial anomaly entropy to adaptively generate an alarm threshold, and adopts a high global anomaly score + low spatial anomaly entropy double condition joint criterion to trigger the alarm, thereby avoiding false positives and false negatives caused by isolated point noise or extensive slight fluctuations in the traditional method, and guaranteeing the compactness and representativeness of the model under long-term operation through a prototype library clustering compression mechanism.

[0068] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and they should be covered in the scope of the claims of the present application.

Claims

1. A neural network-based monitoring data analysis method, characterized by: The method comprises the following steps: acquiring original monitoring data collected by a plurality of monitoring nodes in a continuous time interval, and slicing the original monitoring data according to a preset time window to construct a space-time input tensor; inputting the space-time input tensor into a gated multi-head space-time attention encoder to generate high-level space-time representations through a dynamic gating mechanism, and extracting local outliers corresponding to the monitoring nodes from the high-level space-time representations; normalizing the local outliers to form a spatial anomaly distribution, and calculating a spatial anomaly entropy based on the spatial anomaly distribution; the spatial anomaly entropy represents the discrete degree of abnormal responses among the monitoring nodes; performing space-time pooling on the high-level space-time representations to obtain a global semantic representation vector; defining an initially empty normal behavior prototype library, comparing the global semantic representation vector of the current time window with the stored representations in the normal behavior prototype library in terms of semantic similarity to obtain a global anomaly score; generating an alarm threshold of the current time window based on a sliding statistical value of historical anomaly scores and the spatial anomaly entropy; when the global anomaly score exceeds the alarm threshold and the spatial anomaly entropy is lower than a preset threshold, triggering an abnormal alarm, otherwise, storing the current global semantic representation vector in the normal behavior prototype library to update the normal behavior mode.

2. The neural network-based monitoring data analysis method of claim 1, wherein: The specific steps of inputting the space-time input tensor into the gated multi-head space-time attention encoder to generate high-level space-time representations through the dynamic gating mechanism, and extracting local outliers corresponding to the monitoring nodes from the high-level space-time representations are as follows: The spatiotemporal input tensor formed by the plurality of monitoring nodes in a continuous time interval and sliced by a preset time window is denoted as ; input to a gated multi-head spatial-temporal attention encoder comprising a plurality of parallel attention heads;​ For any attention head, a linear transformation is performed on the query matrix, the key matrix and the value matrix through a learnable weight matrix to obtain a query matrix, a key matrix and a value matrix. ​ To perform global average pooling along the time dimension and the space dimension to obtain a global context vector; inputting the global context vector into a lightweight fully connected layer, and then activating it through a Sigmoid function to generate a gating coefficient vector; element-wise multiplying the gating coefficient vector with a query matrix and a key matrix to obtain a gated query matrix and a gated key matrix; calculating attention weights using the gated query matrix and the gated key matrix, and performing weighted summation on a value matrix to obtain the output of an attention head; concatenate the outputs of all attention heads and linearly project them to form high-level spatio-temporal representations ; For each monitoring node , extract its corresponding spatial location's feature sub-tensor over all time steps, and compute the L2 norm of the sub-tensor as the local anomaly score .​ 3. The neural network-based monitoring data analysis method of claim 2, wherein: The specific steps of normalizing the local outliers to form a spatial anomaly distribution, and calculating a spatial anomaly entropy based on the spatial anomaly distribution are as follows: Collecting local outliers of all monitoring nodes to form a vector ; To Apply the Softmax function for normalization to obtain the spatial anomaly distribution The calculation formula of the first component is ; in, Indicates the first Local outliers of a monitoring node This indicates the total number of monitoring nodes. Represents the natural exponential function; A quantification mechanism based on information entropy is introduced to transform discrete local outliers into a measurable spatial probability structure, based on the spatial anomaly distribution , the spatial anomaly entropy is calculated , the expression is ; wherein, represents the probability weight of the i-th monitoring node in the spatial anomaly distribution, represents the logarithm function with a natural constant as the base, The smaller the numerical value, the more concentrated the abnormal response is in space.​ 4. The neural network-based monitoring data analysis method of claim 3, wherein: The specific steps of defining an initially empty normal behavior prototype library, comparing the global semantic representation vector of the current time window with the stored representations in the normal behavior prototype library in terms of semantic similarity to obtain a global anomaly score are as follows: High-level spatio-temporal representation Perform average pooling along the time dimension and the spatial dimension to obtain a global semantic representation vector ; Initialize an empty set as the normal behavior prototype library ; If non-empty time, each prototype vector contained therein is denoted in turn by , where represents the prototype vector, represents the total number of elements in the set , i.e. the number of normal behavior prototypes currently stored; Computing The cosine similarity of the two vectors is calculated as follows: The cosine similarity of the two vectors is calculated as follows: The cosine similarity of the two vectors is calculated as follows: An abnormal score mechanism based on maximum similarity complementation is introduced, and according to Calculate the global abnormal score Realize the semantic level deviation quantification of the current state and the historical normal mode, the expression is: ; in, , This represents the global semantic representation vector of the current time window. Normal behavior prototype library The first in One prototype vector; like If empty, skip the similarity comparison and... Directly save and will Set to the default initial value.

5. The neural network-based monitoring data analysis method of claim 4, wherein: The specific steps of generating an alarm threshold of the current time window based on a sliding statistical value of historical anomaly scores and the spatial anomaly entropy are as follows: maintain a first-in-first-out queue of length to store the global anomaly scores of the most recent time windows; Whenever a new score is generated is added to the end of the queue, and if the length of the queue exceeds the element at the front of the queue is removed. Computing the arithmetic mean of all elements in the queue as a sliding statistic of the historical anomaly score ; The adaptive adjustment strategy of spatial anomaly entropy dynamically embedded in historical statistics is combined with the spatial anomaly entropy of the current time window , the alarm threshold of the current time window is calculated , the expression is: ; wherein, represents a moving average of historical anomaly scores, represents a preset sensitivity adjustment coefficient, represents a spatial anomaly entropy of a current time window, constitutes an adjustment factor positively correlated with spatial clustering.

6. The neural network-based monitoring data analysis method of claim 5, wherein: The specific steps of storing the current global semantic representation vector in the normal behavior prototype library to update the normal behavior mode are as follows: under the condition that no abnormality alarm is triggered, the global semantic representation vector of the current time window is added to the normal behavior prototype library ;​ When the number of prototypes in exceeds a preset upper limit , perform K-means clustering on all prototype vectors in , and set the number of clustering clusters to In order to maintain the compactness and representativeness of the prototype library in long-term running, a prototype compression mechanism based on clustering centroid is introduced, and the centroid vector of the first cluster is calculated , which is used to preserve the core semantic distribution of normal behavior, and the expression is as follows: ; wherein, represents the number of clusters, represents the set of prototype vectors contained in the represents the number of elements of the set, represents any prototype vector in the set, represents the average representation of the cluster; Replace the original with all centroid vectors. This creates a compressed prototype library of normal behavior. Subsequent semantic similarity comparisons are all based on the compressed prototype library.

7. The neural network-based monitoring data analysis method of claim 6, wherein: When the global anomaly score exceeds the alarm threshold and the spatial anomaly entropy is lower than the preset threshold, an abnormal alarm is triggered, otherwise, the current global semantic representation vector is stored in the normal behavior prototype library, and the normal behavior mode is updated, wherein the preset threshold is a threshold , and satisfies The judgment logic comprises: If the following conditions are met simultaneously and an abnormal alarm is triggered. Otherwise, the current sample is determined to be normal, and the stored ; wherein, represents a global anomaly score, represents an alarm threshold for the current time window, represents a spatial anomaly entropy, represents a preset spatial clustering threshold, represents a total number of monitoring nodes.

8. A neural network-based monitoring data analysis system based on the neural network-based monitoring data analysis method according to any one of claims 1 to 7, characterized by: The method comprises the following steps: a space-time tensor construction module, a gated space-time encoding module, a spatial anomaly entropy calculation module, a global semantic extraction module, a prototype library comparison module, a dynamic threshold generation module, and a double-condition alarm decision module; the space-time tensor construction module is configured to acquire original monitoring data collected by a plurality of monitoring nodes in a continuous time interval, and slice the original monitoring data according to a preset time window to construct a space-time input tensor; The gated spatio-temporal encoding module is configured to input a spatio-temporal input tensor into a gated multi-head spatio-temporal attention encoder, generate high-level spatio-temporal representations through a dynamic gating mechanism, and extract local outliers corresponding to each monitoring node from the high-level spatio-temporal representations. The spatial anomaly entropy calculation module is configured to normalize the local outliers, form a spatial anomaly distribution, and calculate a spatial anomaly entropy based on the spatial anomaly distribution, wherein the spatial anomaly entropy represents a discrete degree of abnormal responses among the monitoring nodes. The global semantic extraction module is configured to pool the high-level spatio-temporal representations along time and space dimensions to obtain a global semantic representation vector. The prototype library comparison module is configured to maintain an initially empty normal behavior prototype library, compare the global semantic representation vector of the current time window with the stored representations in the prototype library in terms of semantic similarity, and output a global anomaly score. The dynamic threshold generation module is configured to adaptively generate an alarm threshold for the current time window based on a sliding statistical value of historical anomaly scores and the current spatial anomaly entropy. The double-condition alarm decision module is configured to determine whether the global anomaly score exceeds the alarm threshold and whether the spatial anomaly entropy is lower than a preset threshold; if both conditions are met, an abnormal alarm is triggered; otherwise, the current global semantic representation vector is stored in the normal behavior prototype library, and the normal behavior mode is updated. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that: The processor executes the computer program to implement the steps of the neural network-based monitoring data analysis method according to any one of claims 1-7.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to implement the steps of the neural network-based monitoring data analysis method according to any one of claims 1-7.

Images