Multi-modal fusion adaptive geophysical instrument data anomaly detection method and device

Abstract

The invention provides a multi-modal fusion adaptive geophysical instrument data anomaly detection method and device, and relates to the technical field of data anomaly detection. The method comprises the following steps: acquiring monitoring data of each geophysical instrument; dynamically distributing weights for different monitoring data by adopting an attention mechanism; performing primary detection on the monitoring data by adopting each preset detection algorithm in a preset detection algorithm set to obtain a plurality of primary detection results; adopting a random forest model to vote the plurality of first-level detection results to obtain an initial anomaly detection result; and according to the anomaly type corresponding to the initial anomaly detection result, performing secondary detection by adopting a corresponding detection method to obtain a final anomaly detection result. According to the invention, the bottleneck of the existing system in the aspects of real-time performance, anomaly type coverage and false alarm rate is solved, and a more robust and adaptive solution is provided for geophysical instrument anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of data anomaly detection technology, and more specifically, to a method and apparatus for detecting data anomalies in multimodal fusion adaptive geophysical instruments. Background Technology

[0002] In recent years, with the rapid development of geophysical observation technology, geophysical instrument anomaly detection systems have gradually become a core means of ensuring the reliability of observational data. Existing systems are typically based on a multi-module architecture, encompassing functions such as data acquisition, anomaly detection algorithms, data storage, and early warning processing. For example, algorithms such as analysis of variance, long short window (STA / LTA), and local outlier factor (LOF) are used to identify anomaly patterns such as jumps, spikes, and step transitions. However, with the increasing complexity of observation scenarios and the surge in data volume, existing technologies have revealed the following limitations in practical applications:

[0003] 1) Insufficient data fusion capability: The existing system uses the linear normalization method to unify the dimensions of multi-source sensor data, but ignores the differences in the distribution of data from different sensors, resulting in significant interference from extreme values. Furthermore, the static weight allocation is difficult to adapt to dynamic environmental changes (such as lightning, rainfall, etc.), limiting the effectiveness of multimodal data collaborative analysis. 2) Incomplete coverage of anomaly types: Traditional methods rely on a single algorithm (such as variance method or LOF) to detect specific anomaly patterns. They are not capable of identifying complex anomalies (such as periodic drift and high-frequency transient noise) and lack differentiated processing mechanisms for anomalies of different durations (second-level equipment failure and day-level precursor data), resulting in a high rate of missed detection. 3) Real-time performance and efficiency bottlenecks: Fixed sliding window and global nearest neighbor search (such as LOF algorithm) lead to computational redundancy, making it difficult to adapt to high-flow data scenarios, and the high memory consumption restricts the deployment capability of edge devices; 4) Poor adaptability of static thresholds: Existing over-limit detection relies on manually preset thresholds, which cannot be dynamically adjusted according to environmental noise, resulting in a high false alarm rate and a lack of false alarm feedback mechanism, thus the system's self-optimization capability is insufficient. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of the prior art by providing a multimodal fusion adaptive geophysical instrument data anomaly detection method and apparatus, so as to solve the bottlenecks of existing systems in terms of real-time performance, anomaly type coverage and false alarm rate, and provide a more robust and adaptive solution for geophysical instrument anomaly detection.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a multimodal fusion adaptive geophysical instrument data anomaly detection method, comprising: acquiring monitoring data from a geophysical instrument; dynamically assigning weights to different monitoring data using an attention mechanism; performing primary detection on the monitoring data using each preset detection algorithm in a preset detection algorithm set to obtain multiple primary detection results; the preset detection algorithm set includes an optimized isolated forest algorithm, an optimized Bayesian change point detection algorithm, an optimized out-of-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm; using a random forest model to vote on the multiple primary detection results to obtain initial anomaly detection results; and performing secondary detection using the corresponding detection method according to the anomaly type corresponding to the initial anomaly detection results to obtain final anomaly detection results.

[0006] In one embodiment, after acquiring the monitoring data from the geophysical instrument, the method further includes: normalizing the different monitoring data using quantile normalization.

[0007] In one implementation, the step of performing first-level detection on the monitoring data using each preset detection algorithm from a preset set of detection algorithms includes: periodically updating the model parameters of the isolated forest algorithm to obtain the optimized isolated forest algorithm; the optimized isolated forest algorithm is shown below: Input: Dataset ,in, ; The output is: Anomaly Score A larger value indicates a higher probability of an anomaly. Construction of the isolation tree: Recursive segmentation: Randomly select a feature from the data. and split values , exist and The data is randomly selected from the left and right subtrees; Termination conditions: Only one data point remains; All data values ​​are the same; Reaching the maximum depth of the tree ; Data Path length in a single isolated tree Defined as the number of edges from the root node to the leaf node; The formula for calculating the average path length is as follows:

[0008] in, The number of isolation trees; The formula for calculating the anomaly score is as follows:

[0009] in, For the number of data items; The harmonic number is an estimate of the average path length; when Approaching 0, A value approaching 1 indicates an anomaly; when tending to , A value approaching 0.5 indicates normal; when... , , indicating outliers or noise; The optimized isolated forest algorithm is used to perform primary detection on the monitoring data.

[0010] In one implementation, the step of performing first-level detection on the monitoring data using each preset detection algorithm from a preset set of detection algorithms includes: dynamically adjusting the threshold of the Bayesian change point detection algorithm based on historical monitoring data to obtain the optimized Bayesian change point detection algorithm; the optimized Bayesian change point detection algorithm is shown below: Assume the monitoring data is as follows: The location of the change point is: The data is divided into two segments: front section Follows distribution ; Later Follows distribution and ; Change point location The prior distribution is As shown below:

[0011] in, It is given The edge likelihood; It is the prior probability of the location of the point of change; The optimized Bayesian change point detection algorithm is used to perform primary detection on the monitoring data.

[0012] In one implementation, the step of performing first-level detection on the monitoring data using each preset detection algorithm in the preset detection algorithm set includes: periodically updating the model parameters of the long short-term memory autoencoder to obtain the optimized long short-term memory autoencoder; and performing first-level detection on the monitoring data using the optimized long short-term memory autoencoder.

[0013] In one implementation, the step of performing secondary detection using a corresponding detection method based on the anomaly type corresponding to the initial anomaly detection result includes: for short-term anomalies, performing secondary detection using wavelet transform and peak detection; the duration of the short-term anomaly is in seconds; for medium- to long-term anomalies, performing secondary detection using STL decomposition combined with LOT density; the duration of the medium- to long-term anomalies is in hours; for long-term anomalies, performing secondary detection using LSTM autoencoder reconstruction error; the duration of the long-term anomaly is in days.

[0014] In one embodiment, after obtaining the final anomaly detection result, the method further includes: storing different monitoring data, multiple first-level detection results, the initial anomaly detection result, and the final anomaly detection result.

[0015] In one embodiment, after obtaining the final anomaly detection result, the method further includes: issuing an anomaly warning based on the final anomaly detection result using a preset information push method.

[0016] In one implementation, after obtaining the final anomaly detection result, the method further includes: performing anomaly control by adopting a corresponding anomaly state control strategy according to the anomaly warning level.

[0017] Secondly, embodiments of this application also provide a multimodal fusion adaptive geophysical instrument data anomaly detection device, comprising: an acquisition module configured to acquire monitoring data from a geophysical instrument; a processing module configured to dynamically assign weights to different monitoring data using an attention mechanism; a first-level detection module configured to perform first-level detection on the monitoring data using each preset detection algorithm in a preset detection algorithm set to obtain multiple first-level detection results; the preset detection algorithm set includes an optimized isolated forest algorithm, an optimized Bayesian change point detection algorithm, an optimized out-of-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm; a random forest model is used to vote on the multiple first-level detection results to obtain an initial anomaly detection result; and a second-level detection module configured to perform second-level detection using a corresponding detection method based on the anomaly type corresponding to the initial anomaly detection result to obtain a final anomaly detection result.

[0018] In one implementation, the acquisition module is configured to normalize the different monitoring data using quantile normalization.

[0019] In one implementation, the primary detection module is configured to periodically update the model parameters of the isolated forest algorithm to obtain the optimized isolated forest algorithm; the optimized isolated forest algorithm is shown below: Input: Dataset ,in, ; The output is: Anomaly Score A larger value indicates a higher probability of an anomaly. Construction of the isolation tree: Recursive segmentation: Randomly select a feature from the data. and split values , exist and The data is randomly selected from the left and right subtrees; Termination conditions: Only one data point remains; All data values ​​are the same; Reaching the maximum depth of the tree ; Data Path length in a single isolated tree Defined as the number of edges from the root node to the leaf node; The formula for calculating the average path length is as follows:

[0020] in, The number of isolation trees; The formula for calculating the anomaly score is as follows:

[0021] in, For the number of data items; The harmonic number is an estimate of the average path length; when Approaching 0, A value approaching 1 indicates an anomaly; when tending to , A value approaching 0.5 indicates normal; when... , , indicating outliers or noise; The optimized isolated forest algorithm is used to perform primary detection on the monitoring data.

[0022] In one implementation, the primary detection module is configured to: dynamically adjust the threshold of the Bayesian change point detection algorithm based on historical monitoring data to obtain the optimized Bayesian change point detection algorithm; the optimized Bayesian change point detection algorithm is shown below: Assume the monitoring data is as follows: The location of the change point is: The data is divided into two segments: front section Follows distribution ; Later Follows distribution and ; Change point location The prior distribution is As shown below:

[0023] in, It is given The edge likelihood; It is the prior probability of the location of the point of change; The optimized Bayesian change point detection algorithm is used to perform primary detection on the monitoring data.

[0024] In one implementation, the primary detection module is configured to: periodically update the model parameters of the long short-term memory autoencoder to obtain the optimized long short-term memory autoencoder; and use the optimized long short-term memory autoencoder to perform primary detection on the monitoring data.

[0025] In one implementation, the secondary detection module is configured to: perform secondary detection using wavelet transform and peak detection for short-term anomalies, wherein the duration of the short-term anomaly is in seconds; perform secondary detection using STL decomposition combined with LOT density for medium-to-long-term anomalies, wherein the duration of the medium-to-long-term anomalies is in hours; and perform secondary detection using LSTM autoencoder reconstruction error for long-term anomalies, wherein the duration of the long-term anomaly is in days.

[0026] In one embodiment, the multimodal fusion adaptive geophysical instrument data anomaly detection device further includes a storage module, which is configured to store different monitoring data, multiple first-level detection results, the initial anomaly detection result, and the final anomaly detection result.

[0027] In one embodiment, the multimodal fusion adaptive geophysical instrument data anomaly detection device further includes an information push module, which is configured to: provide anomaly warnings using a preset information push method based on the final anomaly detection result.

[0028] In one embodiment, the multimodal fusion adaptive geophysical instrument data anomaly detection device further includes a control module, which is configured to perform anomaly control by adopting a corresponding anomaly state control strategy according to the anomaly warning level.

[0029] Thirdly, embodiments of this application provide a computer device, including: a processor, a storage medium, and a bus. The storage medium stores program instructions executable by the processor. When the computer device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of any of the above methods.

[0030] Fourthly, embodiments of this application provide a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of any of the methods described above.

[0031] The beneficial effects of this application are as follows: First, it acquires monitoring data from geophysical instruments; second, it uses an attention mechanism to dynamically assign weights to different monitoring data; third, it uses each preset detection algorithm from a set of preset detection algorithms to perform primary detection on the monitoring data, obtaining multiple primary detection results; the preset detection algorithm set includes an optimized isolated forest algorithm, an optimized Bayesian change point detection algorithm, an optimized out-of-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm; next, it uses a random forest model to vote on the multiple primary detection results to obtain initial anomaly detection results; finally, based on the anomaly type corresponding to the initial anomaly detection results, it uses the corresponding detection method to perform secondary detection, obtaining the final anomaly detection result. Thus, through multimodal fusion, algorithm integration, and dynamic optimization, it solves the bottlenecks of existing systems in terms of real-time performance, anomaly type coverage, and false alarm rate, providing a more robust and adaptive solution for anomaly detection in geophysical instruments. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 A flowchart illustrating a multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application embodiment; Figure 2 A flowchart illustrating a multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application embodiment; Figure 3 A flowchart illustrating a multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application embodiment; Figure 4 A flowchart illustrating a multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application embodiment; Figure 5 A flowchart illustrating a multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application embodiment; Figure 6 This is a schematic diagram of the structure of a multimodal fusion adaptive geophysical instrument data anomaly detection device provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0035] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0036] In the description of this application, it should be noted that if the terms "upper", "lower", etc. appear to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship that the product of this application is usually placed in, it is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0037] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0038] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0039] Figure 1 A flowchart illustrating a multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application embodiment; as shown Figure 1 As shown, the method includes: Step 110: Obtain monitoring data from geophysical instruments.

[0040] The monitoring data includes data from geophysical instruments; specifically, it includes data from fluid monitoring instruments, deformation monitoring instruments, electromagnetic monitoring instruments, and meteorological instruments.

[0041] In practice, after step 110 above, quantile normalization can be used to normalize different monitoring data.

[0042] The purpose of normalization is to eliminate differences in dimensions. After normalization, the data can be mapped to a uniform distribution interval (such as [0, 1]), thus preserving the data distribution characteristics and reducing interference from extreme values.

[0043] Step 120: Use an attention mechanism to dynamically assign weights to different monitoring data.

[0044] The attention mechanism is a mechanism that allows models to focus on key parts when processing information, thereby ignoring irrelevant information and improving processing efficiency and accuracy. It mimics the selective attention characteristic of human vision when processing information. Attention weights are determined by calculating the similarity between query and key vectors, and then the value vectors are weighted and summed to obtain the final output. For example, in lightning warnings, data from electric field sensors is prioritized, while in rainfall warnings, meteorological data is emphasized, and contextual relevance is learned through a gated recurrent unit (GRU).

[0045] Step 130: Use each preset detection algorithm in the preset detection algorithm set to perform first-level detection on the monitoring data to obtain multiple first-level detection results.

[0046] The preset detection algorithm set includes an optimized isolated forest algorithm, an optimized Bayesian change point detection algorithm, an optimized out-of-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm.

[0047] Level 1 testing can also be understood as coarse screening or preliminary testing.

[0048] Furthermore, such as Figure 2As shown, step 130 above may further include steps 210 and 220: Step 210: Periodically update the model parameters of the Isolation Forest algorithm to obtain the optimized Isolation Forest algorithm; the optimized Isolation Forest algorithm is shown below: Input: Dataset ,in, ; The output is: Anomaly Score A larger value indicates a higher probability of an anomaly. Construction of the isolation tree: Recursive segmentation: Randomly select a feature from the data. and split values , exist and The data is randomly selected from the left and right subtrees; Termination conditions: Only one data point remains; All data values ​​are the same; Reaching the maximum depth of the tree ; Data Path length in a single isolated tree Defined as the number of edges from the root node to the leaf node; The formula for calculating the average path length is as follows:

[0049] in, The number of isolation trees; The formula for calculating the anomaly score is as follows:

[0050] in, For the number of data items; The harmonic number is an estimate of the average path length; when Approaching 0, A value approaching 1 indicates an anomaly; when tending to , A value approaching 0.5 indicates normal; when... , , indicating outliers or noise.

[0051] Among them, isolated forest, also known as isolated forest, is an anomaly detection method that starts from outliers, divides the data space according to specified rules, and judges based on the number of divisions; in other words, it is an unsupervised learning algorithm based on tree structure that isolates outliers by randomly dividing the data space, which is suitable for high-dimensional data and has high computational efficiency.

[0052] In this step, the optimized Isolation Forest algorithm, combined with an online learning mechanism, regularly updates the model parameters by updating the data (monitoring data) to adapt to changes in data distribution.

[0053] Step 220: Use the optimized isolated forest algorithm to perform primary detection on the monitoring data.

[0054] Among them, the optimized Isolation Forest algorithm, which uses multi-dimensional monitoring data as feature input, can improve the accuracy of jump detection.

[0055] Furthermore, such as Figure 3 As shown, step 130 above may further include steps 310 and 320: Step 310: Dynamically adjust the threshold of the Bayesian change point detection algorithm based on historical monitoring data to obtain the optimized Bayesian change point detection algorithm.

[0056] Among them, the Bayesian change point detection algorithm is a commonly used method in time series data analysis. It can identify change points in the data, that is, the locations where the data distribution changes significantly. Based on Bayesian statistical theory, this algorithm achieves accurate detection and location of change points through data observation and iterative model updates; in other words, it infers the location of abrupt changes in the data sequence through a probabilistic model, can detect positive / negative jumps, and supports uncertainty quantification.

[0057] The optimized Bayesian change point detection algorithm in this step dynamically adjusts the threshold for judging the magnitude of the jump based on historical data (monitoring data), which can reduce false alarms.

[0058] Step 320: Perform primary detection on the monitoring data using the optimized Bayesian change point detection algorithm; the optimized Bayesian change point detection algorithm is shown below: Assume the monitoring data is as follows: The location of the change point is: The data is divided into two segments: front section Follows distribution ; Later Follows distribution and ; Change point location The prior distribution is As shown below:

[0059] in, It is given The edge likelihood; It is the prior probability of the location of the point of change.

[0060] Among them, the optimized Bayesian change point detection algorithm is used in segments in the real-time data stream (monitoring data) to balance computational efficiency and accuracy.

[0061] Furthermore, such as Figure 4 As shown, step 130 above may further include steps 410 and 420: Step 410: Periodically update the model parameters of the Long Short-Term Memory Autoencoder to obtain the optimized Long Short-Term Memory Autoencoder.

[0062] Among them, the Long Short-Term Memory Autoencoder is a deep learning model that combines a Long Short-Term Memory Network (LSTM) and an autoencoder, specifically designed for processing time series data. It can extract key features of time series (such as periodicity, trend, and abnormal patterns) through compression and reconstruction processes, and then compare the differences between the input data and the reconstructed data (reconstruction error). When the error is significantly higher than the normal range, it is judged as abnormal. In other words, it learns the latent representation of normal data through an encoder-decoder structure and regards data with large reconstruction errors as abnormal.

[0063] The optimized Long Short-Term Memory Autoencoder in this step uses incremental learning techniques to periodically fine-tune the model parameters with new data (monitoring data) to adapt to long-term data drift.

[0064] Step 420: Use the optimized long short-term memory autoencoder to perform primary detection on the monitoring data.

[0065] Among them, the optimized long short-term memory autoencoder, which integrates theoretical data on solid tides with actual observation data, can enhance the model's ability to capture complex patterns.

[0066] STL decomposition breaks down time series into trend, seasonality, and residual components, with a focus on residual anomalies.

[0067] Transformer-based anomaly detection algorithms utilize self-attention mechanisms to capture long-distance dependencies and detect global anomaly patterns.

[0068] In practice, STL decomposition combined with Transformer-based anomaly detection algorithms can be parallelized. For data from multiple stations, a distributed computing framework can be used to accelerate the decomposition and detection process. Furthermore, by combining residual distribution and attention weights, a visual report can be generated to assist in operation and maintenance analysis.

[0069] The optimized over-limit detection method is to optimize the existing over-limit detection method from a static threshold to a dynamic threshold; it can dynamically calculate the upper and lower limit thresholds (such as the 99th percentile) based on the data distribution of the past N days.

[0070] In practice, the optimized over-limit detection method updates the threshold weekly or monthly to adapt to seasonal changes; and it smooths out short-term over-limit data (such as second-level spikes) to reduce false alarms.

[0071] Step 140: Use a random forest model to vote on multiple first-level detection results to obtain initial anomaly detection results.

[0072] Random forest is an ensemble learning method primarily used for classification and regression tasks. It obtains a final prediction by constructing multiple decision trees and voting on or averaging their results.

[0073] The random forest model is constructed through the following steps: Random sampling: Multiple subsets of the dataset are formed by sampling with replacement from the original dataset; Feature randomization: Randomly select a subset of features at each node to construct the decision tree; Decision tree construction: A decision tree is built for each subset of the dataset, and each tree grows fully without pruning; Ensemble prediction: The final prediction is the average of all decision trees (regression task) or the majority vote (classification task).

[0074] By using a random forest model to vote on the first-level detection results obtained from monitoring data by different preset detection algorithms, potential anomalies can be quickly screened out, i.e., the initial anomaly detection results.

[0075] Step 150: Based on the anomaly type corresponding to the initial anomaly detection result, perform secondary detection using the corresponding detection method to obtain the final anomaly detection result.

[0076] The secondary detection stage can be understood as precise screening, precise judgment, and precise detection; the secondary detection stage involves dedicated modules for different anomaly types. Specifically, for example... Figure 5 As shown, step 150 above may further include steps 510 to 530:

[0077] Step 520: For short-term anomalies, wavelet transform and peak detection are used for secondary detection.

[0078] The duration of short-term anomalies is measured in seconds.

[0079] The duration of abnormal waveforms varies under different circumstances. For example, equipment failures last for a short time, measured in seconds, while strong wind interference can last for several hours to several days, and earthquake precursor data needs to be observed on a daily basis. Therefore, the multimodal fusion adaptive geophysical instrument data anomaly detection method provided in this application uses different methods to detect different anomaly types in the secondary detection stage.

[0080] Wavelet Transform (WT) is a novel transform analysis method that inherits and develops the localization concept of the Short-Time Fourier Transform (SFT) while overcoming its limitation of window size not changing with frequency. It provides a frequency-varying "time-frequency" window, making it an ideal tool for time-frequency signal analysis and processing. Wavelet Transform performs multi-scale refinement analysis of signals through operations such as scaling and translation. It can perform time subdivision at high frequencies and frequency subdivision at low frequencies, thus automatically adapting to the requirements of time-frequency signal analysis and focusing on arbitrary details of the signal. This characteristic allows wavelet Transform to overcome the limitations of the Fourier Transform in processing non-stationary signals.

[0081] This step uses wavelet transform and peak detection to capture transient glitches and high-frequency jitter.

[0082] Step 520: For anomalies in the medium to long term, use STL decomposition combined with LOT density for secondary detection.

[0083] The duration of medium- and long-term anomalies is measured in hours.

[0084] Seasonal-Trend Decomposition (STL) using Loess is a technique for decomposing time series data into three components: trend, seasonality, and residuals. First proposed by Cleveland et al. in 1990, this method is commonly used to identify and analyze different components in time series data, helping us understand the basic structure and patterns of the data. The fundamental principle of STL decomposition is to represent time series data as a linear combination of trend, seasonality, and residuals.

[0085] LOT density typically refers to the ratio of a material's mass to its volume under specific conditions.

[0086] This step uses STL decomposition and LOT density to separate trend, seasonality, and residual components, and to identify long-term drift and sudden jumps.

[0087] Step 530: For long-term anomalies, use LSTM autoencoder reconstruction error for secondary detection.

[0088] The duration of long-term anomalies is measured in days.

[0089] An LSTM autoencoder is an autoencoder model based on a Long Short-Term Memory (LSTM) neural network, used for feature extraction and reconstruction tasks of sequence data. It learns a high-level representation of the input sequence and reconstructs it back to the original sequence using a decoder. The LSTM autoencoder works by transforming the input sequence into a low-dimensional representation through the encoder part, and then reconstructing the original sequence from the low-dimensional representation through the decoder part. Both the encoder and decoder consist of LSTM units, which are capable of efficiently handling long-term dependencies in sequence data.

[0090] In practice, it can also store different monitoring data, multiple first-level detection results, initial anomaly detection results, and final anomaly detection results.

[0091] All data from connected station equipment is saved locally in a specified format for a period of no less than one year. In addition, different types of data can be forwarded in real time according to a specified server address, and multiple data streams can be forwarded.

[0092] In practice, anomaly warnings can also be issued by using preset information push methods based on the final anomaly detection results.

[0093] It can access national earthquake early warning (earthquake rapid reporting) information. Upon receiving an early warning (rapid reporting) message, it calculates the impact of an earthquake on the local area. If the impact exceeds a set threshold, it automatically extracts earthquake response data from various devices according to time periods, facilitating timely and unified viewing and analysis by maintenance personnel.

[0094] Various abnormal information can be promptly notified to station maintenance personnel via SMS.

[0095] Customized message pushes can be provided through the MQTT messaging service.

[0096] Of course, it can also provide categorized data label reports for various abnormal information, making it convenient for operation and maintenance and data analysis personnel to use.

[0097] In practice, corresponding abnormal state control strategies can be adopted to control abnormalities based on the abnormality warning level.

[0098] When a mains power outage is detected, the generator can be controlled to start.

[0099] Adjust the air conditioner temperature when the indoor temperature is too high or too low.

[0100] During a high-level lightning warning, disconnect the AC power supply and switch to UPS DC power supply to reduce the impact of lightning strikes on the instruments.

[0101] The comparison results between the multimodal fusion adaptive geophysical instrument data anomaly detection method provided in the application embodiment and related technologies are shown in Table 1 below:

[0102] Table 1 The verification and deployment results are as follows: Simulation test: Using synthetic data (injected with known anomalous patterns) and comparing it with historical station data, the F1 score improved from 0.78 to 0.92.

[0103] Edge computing deployment: Lightweight the precision judgment module (such as TensorFlow Lite) to support running on local devices at the station, reducing data transmission latency.

[0104] Compatibility: The original protocols (MQTT / TCP) are retained, and a new RESTful API is added for third-party algorithm extensions.

[0105] The multimodal fusion adaptive geophysical instrument data anomaly detection method provided in the application embodiment first acquires monitoring data from the geophysical instrument; second, it dynamically assigns weights to different monitoring data using an attention mechanism; third, it performs first-level detection on the monitoring data using each preset detection algorithm from a preset detection algorithm set, obtaining multiple first-level detection results; the preset detection algorithm set includes an optimized isolated forest algorithm, an optimized Bayesian change point detection algorithm, an optimized out-of-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm; next, it uses a random forest model to vote on the multiple first-level detection results to obtain initial anomaly detection results; finally, based on the anomaly type corresponding to the initial anomaly detection results, it uses the corresponding detection method for second-level detection to obtain the final anomaly detection result. Thus, through multimodal fusion, algorithm integration, and dynamic optimization, it solves the bottlenecks of existing systems in terms of real-time performance, anomaly type coverage, and false alarm rate, providing a more robust and adaptive solution for geophysical instrument anomaly detection.

[0106] After introducing the multimodal fusion adaptive geophysical instrument data anomaly detection method according to exemplary embodiments of this disclosure, the following will refer to... Figure 6 The multimodal fusion adaptive geophysical instrument data anomaly detection apparatus 600 according to an exemplary embodiment of the present disclosure will be described.

[0107] refer to Figure 6A multimodal fusion adaptive geophysical instrument data anomaly detection device 600 includes: an acquisition module 610 configured to acquire monitoring data from geophysical instruments; a processing module 620 configured to dynamically assign weights to different monitoring data using an attention mechanism; a first-level detection module 630 configured to perform first-level detection on the monitoring data using each preset detection algorithm in a preset detection algorithm set to obtain multiple first-level detection results; the preset detection algorithm set includes variance method, long and short time window method, step detection method, limit detection method, similarity method, and time series anomaly mining method; a random forest model is used to vote on the multiple first-level detection results to obtain initial anomaly detection results; and a second-level detection module 640 configured to perform second-level detection using the corresponding detection method according to the anomaly type corresponding to the initial anomaly detection results to obtain final anomaly detection results.

[0108] In one implementation, the acquisition module 610 is configured to normalize different monitoring data using quantile normalization.

[0109] In one implementation, the primary detection module 630 is configured to periodically update the model parameters of the isolated forest algorithm to obtain an optimized isolated forest algorithm; the optimized isolated forest algorithm is shown below: Input: Dataset ,in, ; The output is: Anomaly Score A larger value indicates a higher probability of an anomaly. Construction of the isolation tree: Recursive segmentation: Randomly select a feature from the data. and split values , exist and The data is randomly selected from the left and right subtrees; Termination conditions: Only one data point remains; All data values ​​are the same; Reaching the maximum depth of the tree ; Data Path length in a single isolated tree Defined as the number of edges from the root node to the leaf node; The formula for calculating the average path length is as follows:

[0110] in, The number of isolation trees; The formula for calculating the anomaly score is as follows:

[0111] in, For the number of data items; The harmonic number is an estimate of the average path length; when Approaching 0, A value approaching 1 indicates an anomaly; when tending to , A value approaching 0.5 indicates normal; when... , , indicating outliers or noise; An optimized isolated forest algorithm is used for primary detection of the monitoring data.

[0112] In one implementation, the primary detection module 630 is configured to dynamically adjust the threshold of the Bayesian change point detection algorithm based on historical monitoring data to obtain an optimized Bayesian change point detection algorithm; the optimized Bayesian change point detection algorithm is shown below: Assume the monitoring data is as follows: The location of the change point is: The data is divided into two segments: front section Follows distribution ; Later Follows distribution and ; Change point location The prior distribution is As shown below:

[0113] in, It is given The edge likelihood; It is the prior probability of the location of the point of change; An optimized Bayesian change point detection algorithm is used to perform primary detection on the monitoring data.

[0114] In one implementation, the primary detection module 630 is configured to: periodically update the model parameters of the long short-term memory autoencoder to obtain an optimized long short-term memory autoencoder; and use the optimized long short-term memory autoencoder to perform primary detection on the monitoring data.

[0115] In one implementation, the secondary detection module 640 is configured to: perform secondary detection using wavelet transform and peak detection for short-term anomalies; the duration of short-term anomalies is in seconds; perform secondary detection using STL decomposition combined with LOT density for medium-to-long-term anomalies; the duration of medium-to-long-term anomalies is in hours; and perform secondary detection using LSTM autoencoder reconstruction error for long-term anomalies; the duration of long-term anomalies is in days.

[0116] In one embodiment, the multimodal fusion adaptive geophysical instrument data anomaly detection device 600 further includes a storage module configured to store different monitoring data, multiple primary detection results, initial anomaly detection results, and final anomaly detection results.

[0117] In one embodiment, the multimodal fusion adaptive geophysical instrument data anomaly detection device 600 further includes an information push module, which is configured to: provide anomaly warnings using a preset information push method based on the final anomaly detection results.

[0118] In one embodiment, the multimodal fusion adaptive geophysical instrument data anomaly detection device 600 further includes a control module, which is configured to perform anomaly control by adopting a corresponding anomaly state control strategy according to the anomaly warning level.

[0119] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0120] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0121] Figure 7 This is a schematic diagram of a computer device provided in an embodiment of this application. The device can be integrated into a terminal device or a chip of a terminal device. The terminal can be a computing device with data processing capabilities.

[0122] The device includes: a processor 701, a storage medium 702, and a bus 703.

[0123] Storage medium 702 stores program instructions executable by processor 701. When computer device 700 is running, processor 701 communicates with storage medium 702 via bus 703, and processor 701 executes the program instructions to perform the above-described method embodiment. The specific implementation and technical effects are similar and will not be described in detail here.

[0124] Optionally, the present invention also provides a program product, such as a computer-readable storage medium, including a program that, when executed by a processor, is used to perform the above-described method embodiments.

[0125] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0126] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0127] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0128] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute partial steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0129] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A multi-modal fusion adaptive geophysical instrument data anomaly detection method, characterized in that, The method comprises: obtaining monitoring data of each geophysical instrument; dynamically assigning weights to different monitoring data using an attention mechanism; performing primary detection on the monitoring data using each preset detection algorithm in a preset detection algorithm set to obtain multiple primary detection results; the preset detection algorithm set comprises an optimized isolation forest algorithm, an optimized Bayesian change point detection algorithm, an optimized over-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm; performing voting on the multiple primary detection results using a random forest model to obtain an initial anomaly detection result; performing secondary detection using a corresponding detection method according to an abnormal type corresponding to the initial anomaly detection result to obtain a final anomaly detection result.

2. The method of claim 1, wherein, After obtaining the monitoring data of the geophysical instrument, the method further comprises: normalizing different monitoring data using quantile normalization.

3. The method of claim 1, wherein, The method of performing primary detection on the monitoring data using each preset detection algorithm in the preset detection algorithm set comprises: periodically updating model parameters of the isolation forest algorithm to obtain the optimized isolation forest algorithm; the optimized isolation forest algorithm is as follows: Input is: dataset wherein, ; The output is: abnormal score The greater the value, the higher the probability of abnormality. Construction of an isolation tree: Recursive split: randomly select a feature from the data and split value , Randomly choose between and , split the data into left and right sub-trees; Termination condition: Only one data is left; All data values are the same; reaching the maximum depth of the tree ; Data path length in a single isolated tree defined as the number of edges from the root node to the leaf node; The average path length calculation formula is as follows: wherein, is the number of isolated trees; The abnormal score calculation formula is as follows: wherein, is the number of data; is the harmonic number, an estimate of the average path length; when tends to 0, tends to 1, indicating an anomaly; when tends to , tends to 0.5, indicating normal; when , , indicating an outlier or noise; The method of performing primary detection on the monitoring data using the optimized isolation forest algorithm.

4. The method of claim 1, wherein, The method of performing primary detection on the monitoring data using each preset detection algorithm in the preset detection algorithm set comprises: dynamically adjusting a threshold value of the Bayesian change point detection algorithm according to historical monitoring data to obtain the optimized Bayesian change point detection algorithm; the optimized Bayesian change point detection algorithm is as follows: Assume the monitoring data is: ; the change point position is: , the data is divided into two segments: preceding paragraph compliance distribution ; back section compliance distribution and ; Change point location The prior distribution for As follows: wherein, is the edge likelihood for a given ; is the prior probability of a change point location; The method of performing primary detection on the monitoring data using the optimized Bayesian change point detection algorithm.

5. The method of claim 1, wherein, The method of performing primary detection on the monitoring data using each preset detection algorithm in the preset detection algorithm set comprises: periodically updating model parameters of the long short-term memory autoencoder to obtain the optimized long short-term memory autoencoder; The method of performing primary detection on the monitoring data using the optimized long short-term memory autoencoder.

6. The method of claim 1, wherein, The method of performing secondary detection using a corresponding detection method according to an abnormal type corresponding to the initial anomaly detection result comprises: for short-time anomalies, performing secondary detection using wavelet transform and peak detection; the duration of the short-time anomaly is in seconds; for medium and long-time anomalies, performing secondary detection using STL decomposition combined with LOT density; the duration of the medium and long-time anomaly is in hours; for long-time anomalies, performing secondary detection using LSTM autoencoder reconstruction error; the duration of the long-time anomaly is in days.

7. The method of claim 1, wherein, After obtaining the final anomaly detection result, the method further comprises: storing different monitoring data, multiple primary detection results, the initial anomaly detection result, and the final anomaly detection result.

8. The method of claim 1, wherein, After obtaining the final anomaly detection result, the method further comprises: According to the final anomaly detection result, a preset information pushing manner is adopted to perform anomaly early warning.

9. The method of claim 1, wherein, After the final anomaly detection result is obtained, the method further includes: According to the anomaly early warning level, a corresponding anomaly state control strategy is adopted to perform anomaly control.

10. A multi-modal fusion adaptive geophysical instrument data anomaly detection apparatus, characterized in that, Comprise: An acquisition module configured to acquire monitoring data of geophysical instruments; A processing module configured to dynamically assign weights to different monitoring data using an attention mechanism; A first-level detection module configured to perform first-level detection on the monitoring data using each preset detection algorithm in a preset detection algorithm set to obtain a plurality of first-level detection results; the preset detection algorithm set includes an optimized isolation forest algorithm, an optimized Bayesian change point detection algorithm, an optimized over-limit detection method, an optimized long short-term memory autoencoder, and an STL decomposition combined with a Transformer-based anomaly detection algorithm; a random forest model is used to vote on a plurality of first-level detection results to obtain an initial anomaly detection result; A second-level detection module configured to perform second-level detection according to the anomaly type corresponding to the initial anomaly detection result using a corresponding detection method to obtain a final anomaly detection result.

Images