Abnormality detection model explainability analysis method, device, equipment and medium

Abstract

This invention relates to the field of model interpretability technology, and in particular to a method, apparatus, device, and medium for interpretability analysis of anomaly detection models. The method trains an initial anomaly detection model using an acquired model training sample set to obtain a target anomaly detection model. Acquired data to be detected is input into the target anomaly detection model for anomaly detection to obtain anomaly detection results. After anomaly detection, model parameters are extracted to obtain a temporal concept feature set, a sequence association matrix, and a gradient set. Temporal decomposition processing is performed on the temporal concept feature set and the model training sample set to obtain anomaly driving features. Path parsing processing is performed on the sequence association matrix and gradient set to obtain a global attention contribution matrix. Interpretability analysis is performed based on the anomaly driving features and the global attention contribution matrix. An anomaly explanation report is generated based on the obtained anomaly explanation data and anomaly detection results, improving the transparency of anomaly decision-making logic.

Description

Technical Field

[0001] This invention relates to the field of model interpretability technology, and in particular to an interpretability analysis method, apparatus, equipment and medium for anomaly detection models. Background Technology

[0002] Anomaly Transformer, a mainstream model in the field of time-series anomaly detection, relies on an anomaly attention module to simultaneously model prior associations and sequence associations, using the difference between these two types of associations as the core criterion for anomaly determination. This model has been widely applied in several important fields, including industrial monitoring, energy forecasting, and medical time-series analysis, thanks to its excellent detection performance. However, the deep, stacked network structure of Anomaly Transformer, coupled with the inherent black-box nature of its attention mechanism, results in insufficient transparency in the model's anomaly decision-making logic. It fails to clearly present the internal driving mechanism of anomaly generation, severely limiting its reliability and practical application in high-risk scenarios.

[0003] Current interpretability analysis methods for Anomaly Transformers still suffer from several shortcomings that urgently need to be addressed. Traditional feature attribution methods, such as SHAP (Shape Up), focus primarily on low-level time steps or subsequences, failing to capture the high-level concepts actually relied upon in the model's decision-making process, such as trends and periodicity. This leads to significant discrepancies between the interpretation results and the model's true decision-making logic. Single attention link tracing methods, such as Attention Rollout, fail to adapt to the dual-branch structure of the anomaly attention module. During link tracing, fixed weights from prior associations are easily introduced, distorting core association links. Furthermore, these methods do not adequately consider the significant contribution of residual connections to information flow, further reducing the completeness of link tracing. In addition, most existing interpretability analysis methods rely solely on feature attribution or link visualization, failing to establish a correlation verification mechanism between the two analytical results. This results in interpretations that are unreliable and inaccurate for practical applications. Summary of the Invention

[0004] In order to overcome the shortcomings of the prior art, the present invention aims to provide an interpretability analysis method, apparatus, device and medium for anomaly detection models, which aims to improve the transparency of anomaly decision-making logic and effectively enhance the credibility of the model.

[0005] The first aspect of this invention provides a method for interpretability analysis of an anomaly detection model, comprising: acquiring a model training sample set, constructing an initial anomaly detection model, and performing multiple rounds of iterative training on the initial anomaly detection model using the model training sample set to obtain a target anomaly detection model; acquiring data to be detected, inputting the data to be detected into the target anomaly detection model for anomaly detection, and obtaining anomaly detection results; after the target anomaly detection model completes anomaly detection, performing model parameter extraction processing on the target anomaly detection model to obtain an input time-series dataset, the input time-series dataset including a time-series concept feature set, a sequence association matrix, and a gradient set; performing time-series decomposition processing on the time-series concept feature set and the model training sample set to obtain anomaly driving features; performing path parsing processing on the sequence association matrix and the gradient set to obtain a global attention contribution matrix; performing interpretability analysis based on the anomaly driving features and the global attention contribution matrix to obtain anomaly explanation data; and generating an anomaly explanation report based on the anomaly explanation data and the anomaly detection results.

[0006] Optionally, in a first implementation of the first aspect of the present invention, the step of extracting model parameters from the target anomaly detection model to obtain an input time-series dataset includes: acquiring a pre-built deep learning framework, the deep learning framework including a parameter freezing function interface and a parameter acquisition function interface; calling the parameter freezing function interface to freeze the weights and biases of the target anomaly detection model to obtain a stable anomaly detection model; and calling the parameter acquisition function interface to extract model parameters from the stable anomaly detection model to obtain the input time-series dataset.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the step of performing temporal decomposition processing on the temporal concept feature set and the model training sample set to obtain anomaly-driven features includes: performing random sampling processing on the model training sample set using a random sampling algorithm to obtain multiple mask samples; performing temporal decomposition processing on the temporal concept feature set using a temporal decomposition algorithm to obtain multiple high-level concepts; performing temporal decomposition processing on the multiple mask samples based on each high-level concept using a temporal decomposition algorithm to obtain a concept mask value corresponding to each mask sample; and performing contribution quantization processing and sorting and filtering processing based on the high-level concepts and the concept mask values ​​to obtain the anomaly-driven features.

[0008] Optionally, in a third implementation of the first aspect of the present invention, the step of performing contribution quantization and sorting filtering based on the high-level concept and the concept mask value to obtain the anomaly-driven feature includes: performing mask value replacement processing based on the high-level concept and the concept mask value to obtain multiple input masks; inputting the multiple input masks into the stable anomaly detection model for anomaly detection to obtain multiple anomaly scores, and performing average calculation processing on the multiple anomaly scores to obtain an average anomaly score; using a concept contribution quantization algorithm, performing contribution quantization processing based on the average anomaly score and the high-level concept to obtain the SHAP value of each type of high-level concept; obtaining a preset sorting rule, and sorting the SHAP values ​​of each type of high-level concept based on the sorting rule to obtain a sorting result set; obtaining a preset filtering rule, and filtering out the high-level concepts with the highest ranking from the sorting result set as the anomaly-driven feature based on the filtering rule.

[0009] Optionally, in the fourth implementation of the first aspect of the present invention, the step of performing path parsing processing on the sequence association matrix and gradient set to obtain the global attention contribution matrix includes: using a data filtering algorithm to perform prior association matrix elimination processing on the sequence association matrix and gradient set to obtain the target association matrix and gradient set; obtaining a pre-constructed GAF ​​framework, and using the GAF framework to perform tensor construction processing on the target association matrix and gradient set to obtain an information tensor; performing regularization processing on the logarithmic barrier function built into the GAF framework based on the information tensor to obtain the objective function; using a model structure parsing tool to perform model layer structure parsing and time step extraction processing on the stable anomaly detection model to obtain the model time step; performing hierarchical attribution graph construction processing on the model time step based on the information tensor to obtain an adjacency matrix and an identity matrix; performing weighted fusion processing on the adjacency matrix and the identity matrix using a weighted matrix fusion algorithm to obtain a local capacity matrix; and using an interior point algorithm to perform target flow problem transformation and maximum flow optimization processing on the local capacity matrix based on the objective function to obtain the global attention contribution matrix.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the step of constructing a hierarchical attribution graph for the model time step based on the information tensor to obtain an adjacency matrix and an identity matrix includes: obtaining preset graph structure modeling rules; predefining nodes based on the graph structure modeling rules to obtain super source nodes and super target nodes; using the graph structure modeling rules, taking the model time step as a graph intermediate node, the super source node as the global information flow starting point, and the super target node as the global information flow ending point, and assigning values ​​to the graph intermediate nodes using the information tensor to obtain the adjacency matrix; and performing identity matrix dimension matching and construction processing based on the graph intermediate nodes, the global information flow starting point, and the global information flow ending point to construct the identity matrix.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, the step of performing interpretability analysis based on the anomaly-driving features and the global attention contribution matrix to obtain anomaly explanation data includes: using a visualization tool to draw a dual heatmap based on the anomaly-driving features and the global attention contribution matrix, wherein the dual heatmap includes a C-SHAP contribution heatmap and a generalized attention flow global correlation heatmap; using a time-series annotation tool to perform peak node annotation processing on the anomaly-driving features and the global attention contribution matrix to obtain a time-series annotation information set; using a visualization tool to draw a correlation link line graph based on the time-series annotation information set to obtain a correlation link line graph; and performing quantitative verification processing and information integration processing based on the C-SHAP contribution heatmap, the generalized attention flow global correlation heatmap, and the correlation link line graph to obtain the anomaly explanation data.

[0012] A second aspect of the present invention provides an interpretability analysis apparatus for an anomaly detection model, comprising: a model training module for acquiring a model training sample set, constructing an initial anomaly detection model, and performing multiple rounds of iterative training on the initial anomaly detection model using the model training sample set to obtain a target anomaly detection model; an anomaly detection module for acquiring data to be detected, inputting the data to be detected into the target anomaly detection model for anomaly detection, and obtaining anomaly detection results; a parameter extraction module for extracting model parameters from the target anomaly detection model after the target anomaly detection model completes anomaly detection, obtaining an input time-series dataset, wherein the input time-series dataset includes a time-series concept feature set, a sequence association matrix, and a gradient set; a time-series decomposition module for performing time-series decomposition processing on the time-series concept feature set and the model training sample set to obtain anomaly driving features; a path parsing module for performing path parsing processing on the sequence association matrix and gradient set to obtain a global attention contribution matrix; an interpretability analysis module for performing interpretability analysis based on the anomaly driving features and the global attention contribution matrix to obtain anomaly explanation data; and a report generation module for generating an anomaly explanation report based on the anomaly explanation data and the anomaly detection results.

[0013] A third aspect of the present invention provides an interpretability analysis device for an anomaly detection model, the anomaly detection model interpretability analysis device comprising: a memory and at least one processor, the memory storing instructions; the at least one processor calling the instructions in the memory to cause the anomaly detection model interpretability analysis device to perform the various steps of the anomaly detection model interpretability analysis method described in any of the preceding claims.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the interpretability analysis method for the anomaly detection model described in any of the preceding claims.

[0015] In the technical solution of this invention, the initial anomaly detection model is first trained using the acquired model training sample set to obtain the target anomaly detection model. The acquired data to be detected is then input into the target anomaly detection model for anomaly detection to obtain anomaly detection results. After anomaly detection is completed, model parameters are extracted to obtain a temporal concept feature set, a sequence association matrix, and a gradient set. Temporal decomposition processing is performed on the temporal concept feature set and the model training sample set to obtain anomaly driving features. Path parsing processing is performed on the sequence association matrix and gradient set to obtain a global attention contribution matrix. Interpretability analysis is performed based on the anomaly driving features and the global attention contribution matrix. An anomaly explanation report is generated based on the obtained anomaly explanation data and anomaly detection results, thereby improving the transparency of the anomaly decision-making logic and effectively enhancing the credibility of the model. Attached Figure Description

[0016] Figure 1 A logical flowchart of the interpretability analysis method for the anomaly detection model provided in this embodiment of the invention;

[0017] Figure 2 A schematic diagram of the structure of the interpretability analysis device for the anomaly detection model provided in an embodiment of the present invention;

[0018] Figure 3 This is a schematic diagram of the structure of the interpretability analysis device for the anomaly detection model provided in an embodiment of the present invention. Detailed Implementation

[0019] This invention provides an interpretability analysis method, apparatus, device, and medium for anomaly detection models. In this invention, the terms "first," "second," "third," "fourth," etc. (if present)," in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0020] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the interpretability analysis method for the anomaly detection model in this invention includes:

[0021] 101. Obtain the model training sample set, construct an initial anomaly detection model, and use the model training sample set to perform multiple rounds of iterative training on the initial anomaly detection model to obtain the target anomaly detection model;

[0022] In this embodiment, obtaining the model training sample set relies on the actual application scenarios of anomaly detection. Sufficient raw data covering normal time-series patterns and various typical anomaly patterns is collected. The collected data must comprehensively cover different operating conditions and data distribution characteristics under target scenarios such as industrial monitoring and energy forecasting. Simultaneously, the raw data is systematically processed using data preprocessing techniques. Operations such as removing missing values, smoothing noisy data, and correcting anomaly labels ensure the integrity, accuracy, and consistency of the sample set, providing a high-quality data foundation for model training. The initial anomaly detection model is constructed using Anomaly Transformer as the basic network architecture. Combining the task requirements of time-series anomaly detection, the core structural parameters of the model are configured, and the initial values ​​of key parameters such as the number of encoder layers, the number of attention heads, and the dimension of hidden layers are determined. An anomaly attention module is embedded to achieve simultaneous modeling of prior association and sequence association, thus building an initial network structure with basic anomaly detection capabilities. Based on the established model training sample set, the initial anomaly detection model underwent multiple rounds of iterative training. During training, a loss function and optimizer adapted to the characteristics of time-series data were employed. The model's predicted output was calculated through feedforward propagation, and the loss value was solved by combining the real labels. Then, the loss signal was propagated back layer by layer through the backpropagation algorithm, dynamically adjusting the weight parameters and bias terms of each layer of the model. A validation mechanism was introduced during training. After each iteration, the anomaly detection performance of the model was evaluated based on an independent validation set. The changes in key indicators such as precision and recall on the validation set were monitored in real time until the model performance stabilized and met the preset convergence conditions. The iteration was then stopped, and the final network parameter configuration was determined, thereby obtaining the target anomaly detection model. This ensures that the target anomaly detection model has excellent generalization ability and can stably adapt to the time-series anomaly detection requirements under different working conditions, providing a reliable basic model support for subsequent interpretable analysis.

[0023] In this embodiment, the step of obtaining a model training sample set, constructing an initial anomaly detection model, and obtaining a target anomaly detection model through multiple rounds of iterative training needs to be precisely implemented according to the monitoring objects and data characteristics of each scenario. For example, in the photovoltaic power station or energy storage system inverter scenario, historical normal operation data of inverters covering different light, load, and temperature conditions are selected as training samples. In the medical multi-parameter ECG scenario, normal ECG time-series data including parameters such as heart rate and QRS wave width are used as samples. In the energy multi-dimensional consumption scenario, long-term normal data of electricity, gas, and heat consumption are collected. In the industrial equipment multi-sensor scenario, historical normal data of key operating parameters such as vibration, temperature, and oil pressure are collected. For each scenario, an initial anomaly detection model is built based on the AnomalyTransformer architecture, and an anomaly attention module is embedded to achieve synchronous modeling of prior association and sequence association. After configuring core parameters such as the number of encoder layers and the number of attention heads in combination with the scenario data characteristics, multiple rounds of iterative training are carried out. After training, the weights and biases of all layers are frozen, and gradient propagation is disabled to avoid interference with subsequent attribution analysis. Finally, a target anomaly detection model with stable anomaly detection capabilities is formed.

[0024] 102. Obtain the data to be detected, input the data to be detected into the target anomaly detection model to perform anomaly detection, and obtain the anomaly detection result;

[0025] In this embodiment, the data to be detected originates from real-time monitoring systems or historical data reserves in actual application scenarios. It covers various types of time-series data, including photovoltaic inverter operating parameters, medical electrocardiogram signals, and industrial equipment sensor data. The data content comprehensively includes multi-dimensional operating indicators and time-series changes of the monitored object, and has undergone standardized preprocessing to adapt to the input format requirements of the target anomaly detection model. The preprocessed data is input into the target anomaly detection model. The model, relying on a stable decision-making mechanism formed through multiple rounds of iterative training, systematically analyzes the feature patterns in the data. By comparing the distribution patterns of normal data with the characteristics of abnormal features, it accurately identifies abnormal segments, abnormal dimensions, and abnormal degrees in the data. Finally, it outputs anomaly detection results containing information such as anomaly judgment results, anomaly occurrence intervals, and anomaly confidence levels, providing solid foundational data support for subsequent interpretability analysis and credibility assessment.

[0026] 103. After the target anomaly detection model completes anomaly detection, the model parameters of the target anomaly detection model are extracted to obtain the input time series dataset, which includes a time series concept feature set, a sequence association matrix, and a gradient set.

[0027] In this embodiment, the extraction process focuses on the anomaly attention module of the target anomaly detection model. First, model structure analysis techniques are used to locate the computational nodes of each layer of the anomaly attention module, accurately capturing the prior association matrix and sequence association matrix generated during each layer's computation. These two types of matrices serve as the core carriers of the model's time-series data association characteristics, fully recording the model's learning results on the prior data distribution and data-driven association. Simultaneously, gradient tracking is performed on the model's inference process based on the backpropagation principle, calculating and extracting the gradient information corresponding to the attention weights in each layer of the anomaly attention module. This gradient information reflects the sensitivity of the attention weights to the model's anomaly detection results. For the extracted prior association matrix, sequence association matrix, and attention weight gradients, time-series data feature reconstruction techniques are further used for integration and refinement, mining high-level features such as trends and periodicity contained in the data to form a time-series concept feature set. At the same time, the sequence association matrices of each layer and their corresponding attention weight gradients are classified and summarized to construct the sequence association matrix and gradient set. The aforementioned time-series concept feature set, sequence association matrix, and gradient set together constitute a complete input time-series dataset. By extracting the resulting temporal concept feature set, the high-level semantic features learned by the model can be intuitively presented, avoiding subsequent analysis from getting bogged down in the details and redundancy of low-level data. Meanwhile, the sequence association matrix and gradient set fully preserve the computational trajectory and influence relationships of the model's attention mechanism, providing accurate data evidence for tracing the correlation links in anomaly decision-making. Furthermore, this extraction process strictly adheres to the actual computational logic of the target anomaly detection model, ensuring a high degree of consistency between the input temporal dataset and the model's decision-making process. This effectively avoids analytical biases that may be caused by the introduction of external data, significantly improving the authenticity and reliability of subsequent interpretability analysis results.

[0028] 104. Perform temporal decomposition processing on the temporal concept feature set and the model training sample set to obtain anomaly-driven features;

[0029] In this embodiment, the temporal decomposition processing of the temporal concept feature set and the model training sample set is essentially a systematic process of sorting and refining temporal data. This involves removing redundant information and irrelevant components from both datasets, focusing on uncovering the core features that drive the anomaly detection model's decision-making, ultimately forming anomaly-driven features. The temporal concept feature set itself contains high-level semantic attributes of temporal data, while the model training sample set carries rich basic temporal data information. The temporal decomposition process revolves around the core attributes of these two datasets. By integrating the temporal feature correlations between them, key content highly relevant to anomaly judgment is extracted, while secondary information with minimal impact on model decisions is eliminated, ultimately yielding anomaly-driven features. The formation of these anomaly-driven features directly connects to the decision-making logic of the anomaly detection model, providing a precisely focused core analysis object for subsequent interpretability analysis, significantly improving the efficiency and relevance of subsequent analysis work.

[0030] 105. Perform path parsing processing on the sequence correlation matrix and gradient set to obtain the global attention contribution matrix;

[0031] In this embodiment, the sequence association matrix records the model's learning outcomes regarding the dynamic relationships between time-series data, while the gradient set reflects the influence of attention weights on the model's output. Path parsing processing revolves around the inherent relationships between these two types of data. By analyzing the attention transfer logic between different time steps and levels, it clarifies effective association paths and eliminates invalid interference information. Simultaneously, it incorporates gradient influence into the quantitative evaluation of association paths, ultimately forming a global attention contribution matrix that comprehensively characterizes the degree of association contribution of each element globally. This matrix fully presents the association strength and influence relationship between nodes in the time-series data. This path parsing processing effectively solves the problem of scattered information in the sequence association matrix and gradient set, making it difficult to directly use for analysis. It transforms scattered association and gradient data into a structured, quantifiable global attention contribution matrix, providing precise core data support for tracing the subsequent model decision-making logic. The global attention contribution matrix clearly presents the association contribution between each node, intuitively reflecting the key association paths of abnormal model decisions and significantly improving the transparency of the attention mechanism's operation.

[0032] 106. Based on the anomaly-driving features and the global attention contribution matrix, perform interpretability analysis to obtain anomaly explanation data;

[0033] In this embodiment, anomaly-driven features, as key elements in the model's anomaly determination, clarify the core concepts and key time steps influencing anomaly decisions, providing a precise focus for interpretability analysis. The global attention contribution matrix fully presents the correlation strength and transmission path between nodes in the time series data, clearly revealing the information flow trajectory of anomaly features within the model. Interpretability analysis revolves around the intrinsic relationship between these two elements. On one hand, it relies on anomaly-driven features to locate the core triggers of the model's anomaly decisions, clarifying the influence weight of various key concepts on anomaly determination. On the other hand, it combines the global attention contribution matrix to trace the attention transmission links of these core triggers, clarifying the complete path of anomaly information from generation to transmission. Simultaneously, through a combination of visualization and quantitative verification, the abstract feature contributions and correlation paths are transformed into intuitive analytical results. Finally, all analytical conclusions are integrated to form structurally complete and logically clear anomaly explanation data, effectively breaking down the black box barrier of the anomaly detection model, significantly improving the transparency and understandability of the model's decision-making logic. It clarifies the key triggers of anomaly generation and clearly presents the transmission process of anomaly information, providing comprehensive and accurate reference for relevant personnel to understand model decisions and investigate the root causes of anomalies.

[0034] 107. Generate an anomaly explanation report based on the anomaly explanation data and the anomaly detection results.

[0035] In this embodiment, the anomaly explanation data covers concrete elements such as core anomaly driving dimensions, key time steps, and anomaly correlation transmission links, as well as precise values ​​such as weight ratios and correlation coefficients obtained from quantitative verification. It also includes visualization results such as C-SHAP contribution heatmaps and correlation link line charts. The anomaly detection results provide the model's basic judgment conclusions on the data to be detected, including key information such as whether an anomaly has occurred, anomaly confidence level, and preliminary anomaly location. This constitutes the basic judgment framework of the report. The report content not only includes the core conclusions of anomaly detection, but also breaks down the causes, evolution paths, and quantitative supporting evidence of anomaly generation in detail. At the same time, it clarifies the key parameters and feature contribution logic of model decision-making, forming a complete analysis result with both technical depth and practical value. This significantly improves the transparency of anomaly decision-making logic, transforming the abstract algorithm decision-making process that was originally hidden inside the model into clearly interpretable technical basis and business logic through structured reports. This makes model decision-making no longer an elusive black box operation, allowing users such as operation and maintenance personnel and technical decision-makers to understand the ins and outs of anomaly judgment. Meanwhile, the report integrates the basic judgment of anomaly detection results with in-depth analysis of anomaly interpretation data. This dual data support and complete logical deduction significantly enhance the model's credibility. Each anomaly conclusion is accompanied by clear characteristic evidence, quantitative indicators, and visual corroboration, avoiding the problem of model outputs being unreliable due to a lack of support. In high-risk scenarios, this rigorous and readable report provides solid support for decision-making, helping users accurately grasp anomalies and formulate scientific handling plans. It also provides a standardized basis for the model's compliance review and iterative optimization, further promoting the large-scale deployment and in-depth application of anomaly detection models in various professional scenarios.

[0036] In this embodiment of the invention, the step of extracting model parameters from the target anomaly detection model to obtain an input time-series dataset includes: acquiring a pre-built deep learning framework, the deep learning framework including a parameter freezing function interface and a parameter acquisition function interface; calling the parameter freezing function interface to freeze the weights and biases of the target anomaly detection model to obtain a stable anomaly detection model; and calling the parameter acquisition function interface to extract model parameters from the stable anomaly detection model to obtain the input time-series dataset.

[0037] In this embodiment, obtaining a pre-built deep learning framework is fundamental for model parameter processing. This framework needs to have robust model management and parameter manipulation capabilities, with core components including a parameter freezing interface and a parameter acquisition interface. The parameter freezing interface is specifically designed to fix the weights and biases after model training. By calling this interface, the parameters of all layers in the target anomaly detection model can be locked, preventing any changes in subsequent operations. This results in a stable anomaly detection model with stable structure and parameters, ensuring model consistency and effectively avoiding deviations in analysis results caused by model state changes, thus guaranteeing the stability and repeatability of the entire process. After obtaining the stable anomaly detection model, the parameter acquisition interface is called to extract and process its model parameters. This interface can delve into the model's internals and accurately capture key intermediate outputs and feature data. The extracted content mainly includes a time-series concept feature set, a sequence association matrix, and a gradient set. The time-series concept feature set is the result of high-level semantic extraction of the original time-series data, containing features with clear physical or business significance such as trends, cycles, and residuals. The sequence association matrix and gradient set record the dynamic association information between data in various dimensions of the model and the sensitivity of these associations to the model output. This enables accurate and efficient extraction of key model parameters without the need to manually write complex parameter parsing code, reducing the technical implementation difficulty, while ensuring the integrity and accuracy of the extracted data.

[0038] In this embodiment of the invention, the step of performing temporal decomposition processing on the temporal concept feature set and the model training sample set to obtain anomaly-driven features includes: performing random sampling processing on the model training sample set using a random sampling algorithm to obtain multiple mask samples; performing temporal decomposition processing on the temporal concept feature set using a temporal decomposition algorithm to obtain multiple high-level concepts; performing temporal decomposition processing on the multiple mask samples based on each high-level concept using a temporal decomposition algorithm to obtain a concept mask value corresponding to each mask sample; and performing contribution quantization processing and sorting and filtering processing based on the high-level concepts and the concept mask values ​​to obtain the anomaly-driven features.

[0039] In this embodiment, a random sampling algorithm is used to randomly sample the model training sample set. The core is to select a sufficient number of normal samples that are suitable for the scenario requirements from the model training sample set as mask samples. These samples need to comprehensively cover the normal data features under different operating conditions, such as samples with different light load conditions in the photovoltaic inverter scenario, normal heart rate waveform samples in the medical ECG scenario, samples of normal usage periods in the energy consumption scenario, and samples of stable operating parameters in the industrial equipment scenario. Scientific sampling ensures that the mask samples have sufficient representativeness, providing a reliable data foundation for the accurate generation of subsequent concept mask values.

[0040] In this embodiment, a time-series decomposition algorithm is used to process the time-series concept feature set. The chosen algorithm is the Prophet time-series decomposition method. This algorithm can accurately decompose multiple high-level concepts with clear physical or business significance based on the time-series data characteristics of different scenarios. For example, in scenarios such as inverters and industrial equipment, growth trend concepts, short-cycle concepts, long-cycle concepts, and residual concepts can be decomposed. In the medical ECG scenario, growth trend, respiratory cycle, ECG inherent cycle, and residual concepts can be obtained. In the energy consumption scenario, growth trend, daily-week cycle, and residual concepts can be obtained. These high-level concepts effectively replace traditional low-level features, laying the foundation for quantifying concept-level contributions. The time-series decomposition algorithm is used to process multiple mask samples based on each type of high-level concept. This process strictly follows the same Prophet time-series decomposition algorithm as before to ensure the consistency of the decomposition logic. Synchronous decomposition operations are performed on the data of each dimension of each mask sample to obtain the concept mask value corresponding to each mask sample, realizing the accurate correspondence between mask samples and high-level concepts. When performing contribution quantification and ranking based on high-level concepts and concept mask values, the process first involves replacing concepts in the input data that do not belong to that subset with the concept mask values ​​corresponding to the mask samples for any given subset. This process aggregates and generates an input mask that fits the model. The stability of the mask is ensured by averaging the model outputs of multiple mask samples. Then, based on the Shapley value's alliance game theory, the SHAP value of each high-level concept is calculated. Positive values ​​indicate that the concept drives anomaly detection, while negative values ​​indicate that it inhibits anomaly detection. Since the number of concepts is controllable, the SHAP value can be calculated accurately. Finally, the concepts with the highest contribution ranking and their corresponding time steps are selected by ranking. In different scenarios, the core anomaly driving dimensions, anomaly sensors, and anomaly energy types are located, ultimately forming anomaly driving features.

[0041] In this embodiment, the series of processing steps are supported by the core logic of the C-SHAP algorithm. C-SHAP is an extension method based on the SHAP (Shapley Additive Explanations) framework, specifically used for the quantitative analysis of the contribution of high-level concepts to model decision-making. It effectively solves the problem that traditional feature attribution methods focus on low-level features and have large explanatory biases. By constructing high-level concepts, it achieves a precise deconstruction of the model's decision-making logic. The introduction of high-level concepts not only gives features clear physical and business meanings, making it easier for relevant personnel to understand the essential reasons for the occurrence of anomalies, but also avoids the problem of SHAP calculation growing exponentially with the number of features, significantly improving the computational efficiency of contribution quantification.

[0042] In this embodiment of the invention, the step of performing contribution quantization and sorting filtering based on the high-level concepts and the concept mask values ​​to obtain the anomaly-driving features includes: performing mask value replacement processing based on the high-level concepts and the concept mask values ​​to obtain multiple input masks; inputting the multiple input masks into the stable anomaly detection model for anomaly detection to obtain multiple anomaly scores, and performing average calculation processing on the multiple anomaly scores to obtain an average anomaly score; using a concept contribution quantization algorithm, performing contribution quantization processing based on the average anomaly score and the high-level concepts to obtain the SHAP value of each type of high-level concept; obtaining a preset sorting rule, and sorting the SHAP values ​​of each type of high-level concept based on the sorting rule to obtain a sorting result set; obtaining a preset filtering rule, and filtering out the top-ranked high-level concepts from the sorting result set as the anomaly-driving features based on the filtering rule.

[0043] In this embodiment, the process of quantifying contribution and sorting based on high-level concepts and concept mask values ​​to obtain anomaly-driven features strictly follows the core logic of the C-SHAP algorithm. During mask value replacement, based on the constructed complete high-level concept system, for any subset of concepts, concepts in the input data that do not belong to that subset are precisely replaced with the concept mask values ​​of the corresponding mask samples. In multi-dimensional scenarios, the concept replacement operations for each dimension need to be completed simultaneously. For example, non-target concepts in various monitoring dimensions in the inverter multivariate scenario, various ECG parameter dimensions in the medical ECG scenario, and various sensor dimensions in the industrial equipment scenario all need to be replaced synchronously to ensure that the replaced data can completely retain the target concept information and eliminate irrelevant interference. This series of operations generates multiple structurally standardized input masks. These multiple input masks are then input one by one into a stable anomaly detection model for anomaly detection. The model outputs a corresponding anomaly score for each input mask. These anomaly scores reflect the model's judgment results on anomalies under different concept combinations. To eliminate random errors caused by single-sample detection, the average value of all anomaly scores is calculated to obtain an average anomaly score that stably reflects the overall influence of the concepts. The mask value replacement process, combined with multi-dimensional synchronous operation, ensures the integrity and relevance of the input mask, providing a high-quality data foundation for subsequent outlier score calculation. The calculation of the average outlier score significantly reduces the interference of random errors on the results, greatly improving the stability and reliability of contribution quantification.

[0044] In this embodiment, the concept contribution quantification algorithm is essentially based on the Shapley value alliance game idea. The algorithm uses the average anomaly score as the benchmark and combines the attribute characteristics of various high-level concepts to accurately calculate the contribution of each type of high-level concept to the anomaly judgment. Finally, it obtains the SHAP value corresponding to each type of high-level concept. When the SHAP value is positive, it means that the concept plays a promoting role in the anomaly judgment, and when it is negative, it means that it plays a suppressive role. Since the number of high-level concepts in various scenarios is controllable, the accurate solution of the SHAP value can be achieved without complex approximate calculations. The preset sorting rule is to sort by contribution from highest to lowest to obtain a sorted result set. Then, according to the preset filtering rule, key concepts and corresponding time steps are selected. The filtering rule is to select the Top-K concepts with the highest SHAP values. Top-K is the core operation strategy of selecting the top K concepts and their corresponding time steps after sorting the SHAP values ​​of various high-level concepts. Here, K is a preset quantitative filtering threshold based on business scenarios and data characteristics. The K value is usually set to 5%-10% of the sequence length. In different scenarios, the core anomaly driving dimension, core anomaly sensor, core anomaly energy type, etc. are respectively located, and finally integrated to form an anomaly driving feature that accurately points to the root cause of the anomaly. The concept contribution quantification algorithm based on Shapley value realizes accurate scoring of high-level concepts. Compared with the traditional attribution method that focuses on low-level features, the SHAP value of high-level concepts has more explicit physical or business meaning, which can clearly reveal the essential cause of the anomaly. At the same time, it avoids the problem of exponential growth in computational complexity caused by too many features, and balances computational efficiency and result accuracy. The sorting and filtering process, through scientifically set thresholds, accurately extracts the core anomaly-driving features and eliminates minor concepts with weak influence, enabling subsequent interpretability analysis to focus on the core and significantly improving analysis efficiency.

[0045] In this embodiment of the invention, the step of performing path parsing processing on the sequence association matrix and gradient set to obtain the global attention contribution matrix includes: using a data filtering algorithm to perform prior association matrix elimination processing on the sequence association matrix and gradient set to obtain the target association matrix and gradient set; obtaining a pre-constructed GAF ​​framework, and using the GAF framework to perform tensor construction processing on the target association matrix and gradient set to obtain an information tensor; performing regularization processing on the logarithmic barrier function built into the GAF framework based on the information tensor to obtain the objective function; using a model structure parsing tool to perform model layer structure parsing and time step extraction processing on the stable anomaly detection model to obtain the model time step; performing hierarchical attribution graph construction processing on the model time step based on the information tensor to obtain an adjacency matrix and an identity matrix; performing weighted fusion processing on the adjacency matrix and the identity matrix using a weighted matrix fusion algorithm to obtain a local capacity matrix; and using an interior point algorithm to perform target flow problem transformation and maximum flow optimization processing on the local capacity matrix based on the objective function to obtain the global attention contribution matrix.

[0046] In this embodiment, the prior association matrix is ​​constructed based on a fixed Gaussian kernel, lacking multi-layered transitive meaning and failing to reflect the true association features learned by the model from the data. Therefore, this filtering algorithm precisely removes this invalid information, retaining only the sequence association matrix and corresponding gradient set that reflect the dynamic association patterns of the data. This ultimately yields the target association matrix and gradient set, providing a clean and analytically valuable data foundation for the subsequent construction of the information tensor. The pre-built GAF framework, short for Generalized Attention Flow Framework, is a core tool for interpretable analysis specifically designed for attention mechanism-driven anomaly detection models. Its core objective is to address the non-uniqueness of optimal flow in traditional attention flow link tracing, achieving accurate quantification and tracing of anomaly information transmission paths. This, in turn, matches the concept-level feature contributions located by the C-SHAP algorithm, constructing a complete interpretive system combining feature contributions and association links. After obtaining the pre-built GAF framework, the framework is used to construct tensors for the target correlation matrix and gradient set. Adaptation processing is performed for the characteristics of different application scenarios. For example, in multi-dimensional scenarios such as inverters and industrial equipment, the element-wise product of the correlation matrix and gradient of each dimension sequence is first calculated. After retaining positive values, the mean of cross-attention head and cross-dimensional mean is taken to ensure that multi-dimensional feedforward correlation and gradient-sensitive information are captured at the same time. In scenarios such as medical electrocardiogram and energy consumption, information tensors containing cross-dimensional or cross-energy type correlations are constructed. Through this standardized and scenario-adaptive construction method, an information tensor that can comprehensively represent dynamic correlation and gradient-sensitive information is finally formed.

[0047] In this embodiment, the logarithmic barrier function built into the GAF framework is regularized based on the information tensor. The core purpose is to address the non-uniqueness of optimal flow in the maximum flow optimization problem of traditional attention flow. By constraining and transforming the original optimization problem through the logarithmic barrier function, a strictly convex objective function is constructed. This objective function not only ensures the uniqueness of subsequent optimization solutions but also satisfies the efficiency, symmetry, invalidity, and linear axiom of the Shapley value, providing theoretical support for the rationality and scientific validity of the attribution results. Next, a model structure analysis tool is used to analyze the model layer structure and extract time steps of the stable anomaly detection model. The computational nodes of each layer of the Anomaly Transformer are accurately located, and the time steps of each layer are extracted as the core nodes for the subsequent construction of the hierarchical attribution graph, ensuring that the graph nodes can completely cover the hierarchical structure and temporal characteristics of the model.

[0048] In this embodiment, a hierarchical attribution graph is constructed based on the information tensor and model time steps. Super source nodes and super target nodes are introduced to form an adjacency matrix and an identity matrix that reflect the strength of associations between nodes, thus fully reconstructing the information flow transmission path in the model. Then, a weighted matrix fusion algorithm is used to weight and fuse the adjacency matrix and identity matrix. Reasonable fusion weights are set according to the model's structural characteristics and information flow transmission rules. In each scenario, the two are fused with fixed weights, preserving the dynamic association information represented by the information tensor while incorporating the direct information flow contribution of residual connections. Finally, a local capacity matrix is ​​obtained, overcoming the shortcomings of traditional methods that ignore residual links, and enabling the local capacity matrix to comprehensively reflect the information flow transmission characteristics within the model. Finally, an interior-point algorithm is employed to transform the target flow problem and perform maximum flow optimization based on the objective function and local capacity matrix. This transforms the original multi-layered, multi-source, multi-objective flow problem into a more easily solvable single-source, single-objective flow problem. The interior-point algorithm efficiently solves the regularized maximum flow optimization problem, yielding a global attention contribution matrix. The elements in this matrix accurately represent the degree of correlation contribution between different time steps or dimensions. In various scenarios, this matrix can achieve objectives such as core driver dimension correlation link tracing and cross-sensor anomaly information transmission path localization. This process leverages the core advantages of the GAF framework, precisely adapts to the structural characteristics of the Anomaly Transformer, and effectively solves key problems in traditional attention flow link tracing, such as the non-uniqueness of the optimal flow and attribution ambiguity, significantly improving the accuracy and reliability of correlation link tracing.

[0049] In this embodiment of the invention, the step of constructing a hierarchical attribution graph for the model time step based on the information tensor to obtain an adjacency matrix and an identity matrix includes: obtaining preset graph structure modeling rules; predefining nodes based on the graph structure modeling rules to obtain super source nodes and super target nodes; using the graph structure modeling rules, taking the model time step as a graph intermediate node, the super source node as the global information flow starting point, and the super target node as the global information flow ending point, and assigning values ​​to the graph intermediate nodes using the information tensor to obtain the adjacency matrix; and performing identity matrix dimension matching and construction processing based on the graph intermediate nodes, the global information flow starting point, and the global information flow ending point to construct the identity matrix.

[0050] In this embodiment, pre-defined graph structure modeling rules are obtained. These rules are pre-defined based on the hierarchical structure characteristics of Anomaly Transformer and the link tracing requirements of generalized attention flow. They clarify core specifications such as node definitions, node association methods, and information flow directions, providing a unified basis for the standardized construction of the subsequent graph structure. Based on these graph structure modeling rules, nodes are pre-defined, accurately determining the functional positioning of super-source nodes and super-target nodes. These two nodes are the key core for integrating the multi-layered information flow of the model, used to solve the problem of dispersion in multi-layered, multi-source, and multi-target flow problems, providing fundamental support for the unified convergence and transmission of subsequent information flows. The graph structure construction process relies on the pre-defined standardized modeling rules, ensuring the standardization and consistency of node definitions and graph structure construction. This avoids problems such as node confusion and unclear association logic caused by manual construction, laying a regular structural foundation for subsequent matrix processing and flow problem solving. The introduction of super-source nodes and super-target nodes effectively solves the problem of dispersion in multi-source, multi-target flow problems caused by the multi-layered structure of Anomaly Transformer, achieving unified control of global information flow and improving the systematic nature of link tracing.

[0051] In this embodiment, based on graph structure modeling rules, the extracted model time steps are used as intermediate nodes in the graph. These intermediate nodes fully cover the temporal features of each layer of the Anomaly Transformer and can comprehensively carry the transmission of related information within the model. Simultaneously, the super source node is clearly defined as the sole starting point of the global information flow, responsible for coordinating and distributing initial related information, while the super target node, as the final endpoint of the global information flow, is responsible for aggregating the related information transmitted by intermediate nodes at each layer, forming a complete information flow loop. Based on this, the constructed information tensor is used to assign values ​​to the intermediate nodes of the graph. The dynamic related information and gradient-sensitive information contained in the information tensor are accurately mapped to the capacity values ​​of the edges between intermediate nodes. In multi-dimensional scenarios such as inverters and industrial equipment, this assignment process also incorporates cross-dimensional related information, enabling the edge capacity to reflect the temporal correlation between dimensions, ultimately forming an adjacency matrix that can fully characterize the strength of the correlation between nodes. The core of the identity matrix dimension matching and construction process based on the graph intermediate nodes, the starting point of the global information flow, and the ending point of the global information flow is to ensure that the identity matrix can achieve subsequent weighted fusion with the adjacency matrix. The dimension of the identity matrix strictly matches the dimension of the adjacency matrix. Its core function is to specifically represent the direct information flow of residual connections, making up for the deficiency of neglecting the contribution of residual links in traditional graph construction. It fully restores the two transmission paths of information flow in the model, namely the indirect association transmission through the attention mechanism and the direct information flow transmission through residual connections. Finally, the identity matrix is ​​constructed. The dimension-matched identity matrix fully incorporates the information flow contribution of residual connections, so that the graph structure fully covers the information flow transmission path inside the model. It breaks the limitation of traditional methods that only focus on attention association and ignore residual links, and improves the completeness of the subsequent local capacity matrix.

[0052] In this embodiment of the invention, the step of performing interpretability analysis based on the anomaly driving features and the global attention contribution matrix to obtain anomaly explanation data includes: using visualization tools to draw dual heatmaps based on the anomaly driving features and the global attention contribution matrix, the dual heatmaps including a C-SHAP contribution heatmap and a generalized attention flow global correlation heatmap; using time-series annotation tools to perform peak node annotation processing on the anomaly driving features and the global attention contribution matrix to obtain a time-series annotation information set; using visualization tools to draw correlation link line graphs based on the time-series annotation information set to obtain correlation link line graphs; and performing quantitative verification processing and information integration processing based on the C-SHAP contribution heatmap, the generalized attention flow global correlation heatmap, and the correlation link line graphs to obtain the anomaly explanation data.

[0053] In this embodiment, a visualization tool is used to create dual heatmaps based on anomaly-driven features and a global attention contribution matrix. The core of this process is to transform abstract feature contribution and correlation information into intuitive visual charts. The rendering process is closely adapted to the data analysis needs of different application scenarios. For example, in the scenario of anomaly analysis of multivariate time-series data from inverters, the dual heatmaps are divided into regions according to monitoring dimensions. One side clearly displays the C-SHAP contribution of each dimension, accurately highlighting the core driving dimension and its corresponding time step; the other side presents a multi-dimensional global correlation heatmap, using differentiated display annotations of high-weight correlation links across dimensions. In scenarios such as medical ECG, energy consumption, and industrial equipment, the heatmaps specifically highlight core anomaly dimensions, cross-energy type correlation links, and cross-sensor correlation features, ultimately forming a C-SHAP contribution heatmap and a generalized attention flow global correlation heatmap that clearly present the correspondence between core concepts and correlation paths.

[0054] In this embodiment, a time-series annotation tool is used to annotate peak nodes in the anomaly-driven features and the global attention contribution matrix. First, the weight values ​​of corresponding columns are accurately extracted from the global attention contribution matrix. These weight values ​​directly reflect the correlation contribution strength between different time steps. Simultaneously, the correlation transmission nodes corresponding to the weight peaks are annotated, completely recording the key node information in the anomaly information transmission path, and integrating them to form a structured time-series annotation information set. A visualization tool is then used to draw correlation link line charts based on the time-series annotation information set. In scenarios such as inverters and industrial equipment, the charts are drawn according to the core dimensions, clearly showing the correlation contribution change trends of the core time steps in each dimension. Other scenarios will also be adapted to the core analysis object, ultimately resulting in a correlation link line chart. Quantitative verification and information integration are performed based on C-SHAP contribution heatmaps, generalized attention flow global correlation heatmaps, and correlation link line charts. The quantitative verification stage calculates the proportion of the total weight of the correlation links at the core time step to the total weight of all links, thereby determining the main core links driving anomaly decisions. Simultaneously, it verifies the correlation between the SHAP value of the core anomaly driving concept and the corresponding correlation link weights. Furthermore, cross-validation is conducted using actual business data from various scenarios. For example, in inverter scenarios, maintenance records are referenced; in medical scenarios, doctor's diagnostic reports are compared; in energy scenarios, meteorological data and scheduling records are combined; and in industrial equipment scenarios, maintenance records and production condition data are matched. Finally, the visualized charts, quantitative verification results, and cross-validation conclusions are systematically integrated to form anomaly explanation data, comprehensively elucidating the core basis and internal logic of the model's anomaly decisions.

[0055] The interpretability analysis method of the anomaly detection model in the embodiments of the present invention has been described above. The interpretability analysis device of the anomaly detection model in the embodiments of the present invention will be described below. Please refer to [link / reference]. Figure 2One embodiment of the interpretability analysis device for the anomaly detection model in this invention includes:

[0056] Model training module 201: used to obtain a model training sample set, construct an initial anomaly detection model, and use the model training sample set to perform multiple rounds of iterative training on the initial anomaly detection model to obtain a target anomaly detection model;

[0057] Anomaly detection module 202: used to acquire data to be detected, input the data to be detected into the target anomaly detection model for anomaly detection, and obtain anomaly detection results; after the target anomaly detection model completes anomaly detection,

[0058] Parameter extraction module 203: used to extract model parameters from the target anomaly detection model to obtain an input time series dataset, wherein the input time series dataset includes a time series concept feature set, a sequence correlation matrix, and a gradient set;

[0059] Temporal decomposition module 204: used to perform temporal decomposition processing on the temporal concept feature set and the model training sample set to obtain anomaly-driven features;

[0060] Path parsing module 205: used to perform path parsing processing on the sequence correlation matrix and gradient set to obtain the global attention contribution matrix;

[0061] Interpretability analysis module 206: used to perform interpretability analysis based on the anomaly driving features and the global attention contribution matrix to obtain anomaly explanation data;

[0062] Report generation module 207: Used to generate an anomaly explanation report based on the anomaly explanation data and the anomaly detection results.

[0063] Based on the same ideas as the methods in the above embodiments, the apparatus provided in this application can implement the methods in the above embodiments.

[0064] above Figure 2 The interpretability analysis device of the anomaly detection model in the embodiments of the present invention will be described in detail from the perspective of modular functional entities. The interpretability analysis device of the anomaly detection model in the embodiments of the present invention will be described in detail from the perspective of hardware processing.

[0065] Figure 3This is a schematic diagram of the structure of an interpretability analysis device for an anomaly detection model provided in an embodiment of the present invention. The interpretability analysis device 300 for the anomaly detection model can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 310 (e.g., one or more processors) and a memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 333 or data 332. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the interpretability analysis device 300 for the anomaly detection model. Furthermore, the processor 310 may be configured to communicate with the storage media 330 and execute a series of instruction operations on the storage media 330 on the interpretability analysis device 300 for the anomaly detection model to implement the steps of the interpretability analysis method for the anomaly detection model provided in the above-described method embodiments.

[0066] The anomaly detection model interpretability analysis device 300 may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 3 The illustrated structure of the interpretability analysis device for the anomaly detection model does not constitute a limitation on the interpretability analysis device for the anomaly detection model. It may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0067] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the steps of an interpretability analysis method for an anomaly detection model.

[0068] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system, device, or unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0069] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0070] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for interpretability analysis of an anomaly detection model, characterized in that, include: Obtain a model training sample set, construct an initial anomaly detection model, and use the model training sample set to perform multiple rounds of iterative training on the initial anomaly detection model to obtain a target anomaly detection model. Obtain the data to be detected, input the data to be detected into the target anomaly detection model for anomaly detection, and obtain the anomaly detection result; After the target anomaly detection model completes anomaly detection, a pre-built deep learning framework is obtained. The deep learning framework includes a parameter freezing function interface and a parameter acquisition function interface. The parameter freezing function interface is called to freeze the weights and biases of the target anomaly detection model to obtain a stable anomaly detection model. The parameter acquisition function interface is called to extract the model parameters of the stable anomaly detection model to obtain an input time series dataset. The input time series dataset includes a time series concept feature set, a sequence association matrix, and a gradient set. The time series concept feature set contains high-level semantic attributes of the time series data. Temporal decomposition processing is performed on the temporal concept feature set and the model training sample set to obtain anomaly-driven features; A data filtering algorithm is used to remove prior correlation matrices from the sequence correlation matrix and gradient set to obtain the target correlation matrix and gradient set. A pre-constructed GAF ​​framework is obtained, and the target correlation matrix and gradient set are constructed using the GAF framework to obtain an information tensor. Based on the information tensor, the logarithmic barrier function built into the GAF framework is regularized to obtain the objective function. A model structure analysis tool is used to analyze the model layer structure and extract the time steps of the stable anomaly detection model to obtain the model time steps. Pre-defined graph structure modeling rules are obtained, and nodes are predefined based on the graph structure modeling rules to obtain super source nodes and super target nodes. Based on the graph structure... The modeling rules are as follows: the model time step is taken as the intermediate node of the graph, the super source node is taken as the starting point of the global information flow, and the super target node is taken as the ending point of the global information flow. The intermediate node of the graph is assigned a value using the information tensor to obtain the adjacency matrix. Based on the intermediate node of the graph, the starting point of the global information flow, and the ending point of the global information flow, the identity matrix dimension matching and construction processing is performed to construct the identity matrix. The adjacency matrix and the identity matrix are weighted and fused using a weighted matrix fusion algorithm to obtain the local capacity matrix. The interior point algorithm is used to transform the local capacity matrix into a target flow problem and optimize the maximum flow based on the objective function to obtain the global attention contribution matrix. Interpretability analysis is performed based on the anomaly-driving features and the global attention contribution matrix to obtain anomaly explanation data; An anomaly explanation report is generated based on the anomaly explanation data and the anomaly detection results.

2. The interpretability analysis method for the anomaly detection model according to claim 1, characterized in that, The step of performing temporal decomposition processing on the temporal concept feature set and the model training sample set to obtain anomaly-driven features includes: The training sample set of the model is randomly sampled using a random sampling algorithm to obtain multiple mask samples; The temporal concept feature set is decomposed using a temporal decomposition algorithm to obtain multiple high-level concepts. A temporal decomposition algorithm is used to perform temporal decomposition processing on multiple mask samples based on each type of high-level concept to obtain the concept mask value corresponding to each mask sample. Based on the high-level concept and the concept mask value, contribution quantification and sorting filtering are performed to obtain the anomaly driving feature.

3. The interpretability analysis method for the anomaly detection model according to claim 2, characterized in that, The process of contribution quantification and sorting based on the high-level concept and the concept mask value to obtain the anomaly-driven features includes: Based on the high-level concept and the concept mask value, a mask value replacement process is performed to obtain multiple input masks; Multiple input masks are input into the stable anomaly detection model to perform anomaly detection, resulting in multiple anomaly scores. The average of the multiple anomaly scores is then calculated to obtain the average anomaly score. A concept contribution quantification algorithm is used to perform contribution quantification processing based on the average of the outlier scores and the high-level concepts to obtain the SHAP value of each type of high-level concept. Obtain a preset sorting rule, and sort the SHAP values ​​of each type of high-level concept based on the sorting rule to obtain a sorting result set; Obtain preset filtering rules, and based on the filtering rules, filter out the top-ranked high-level concepts from the sorted result set as the anomaly driving features.

4. The interpretability analysis method for the anomaly detection model according to claim 1, characterized in that, The interpretability analysis based on the anomaly-driving features and the global attention contribution matrix yields anomaly explanation data, including: Using visualization tools, dual heatmaps are drawn based on the anomaly-driven features and the global attention contribution matrix. The dual heatmaps include a C-SHAP contribution heatmap and a generalized attention flow global correlation heatmap. A temporal annotation tool is used to annotate the anomaly-driven features and the global attention contribution matrix to obtain a temporal annotation information set; Using visualization tools, a line graph of the associated links is drawn based on the time-series annotation information set to obtain the associated link line graph. The anomaly explanation data is obtained by performing quantitative verification and information integration processing based on the C-SHAP contribution heatmap, the generalized attention flow global correlation heatmap, and the correlation link line graph.

5. An interpretability analysis device for an anomaly detection model, characterized in that, include: Model training module: used to obtain a model training sample set, construct an initial anomaly detection model, and use the model training sample set to perform multiple rounds of iterative training on the initial anomaly detection model to obtain a target anomaly detection model; Anomaly detection module: used to acquire data to be detected, input the data to be detected into the target anomaly detection model to perform anomaly detection, and obtain anomaly detection results; The parameter extraction module is used to obtain a pre-built deep learning framework after the target anomaly detection model completes anomaly detection. The deep learning framework includes a parameter freezing function interface and a parameter acquisition function interface. The parameter freezing function interface is called to freeze the weights and biases of the target anomaly detection model to obtain a stable anomaly detection model. The parameter acquisition function interface is called to extract model parameters from the stable anomaly detection model to obtain an input time series dataset. The input time series dataset includes a time series concept feature set, a sequence association matrix, and a gradient set. The time series concept feature set contains high-level semantic attributes of the time series data. Temporal decomposition module: used to perform temporal decomposition processing on the temporal concept feature set and the model training sample set to obtain anomaly-driven features; Path parsing module: This module uses a data filtering algorithm to perform prior correlation matrix removal on the sequence correlation matrix and gradient set to obtain the target correlation matrix and gradient set; acquires a pre-constructed GAF ​​framework, and uses the GAF framework to perform tensor construction on the target correlation matrix and gradient set to obtain an information tensor; performs regularization on the logarithmic barrier function built into the GAF framework based on the information tensor to obtain the objective function; uses a model structure parsing tool to perform model layer structure parsing and time step extraction on the stable anomaly detection model to obtain the model time step; acquires preset graph structure modeling rules, and predefines nodes based on the graph structure modeling rules to obtain super source nodes and super target nodes; based on... The graph structure modeling rules define the model time step as the graph intermediate node, the super source node as the global information flow starting point, and the super target node as the global information flow ending point. The information tensor is used to assign values ​​to the graph intermediate nodes to obtain an adjacency matrix. Based on the graph intermediate nodes, the global information flow starting point, and the global information flow ending point, identity matrix dimension matching and construction are performed to construct an identity matrix. A weighted matrix fusion algorithm is used to weight and fuse the adjacency matrix and the identity matrix to obtain a local capacity matrix. Finally, an interior point algorithm is used to transform the local capacity matrix into a target flow problem and optimize the maximum flow based on the objective function to obtain a global attention contribution matrix. Interpretability analysis module: used to perform interpretability analysis based on the anomaly driving features and the global attention contribution matrix to obtain anomaly explanation data; Report generation module: used to generate an anomaly explanation report based on the anomaly explanation data and the anomaly detection results.

6. An interpretability analysis device for an anomaly detection model, characterized in that, The interpretability analysis device for the anomaly detection model includes: a memory and at least one processor, wherein the memory stores instructions; At least one of the processors invokes the instructions in the memory to cause the anomaly detection model interpretability analysis device to perform the steps of the anomaly detection model interpretability analysis method as described in any one of claims 1-4.

7. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the steps of the interpretability analysis method for the anomaly detection model as described in any one of claims 1-4.

Images