Method and system for industrial equipment operation monitoring anomaly detection based on multi-layer dynamic graph

Abstract

The application provides an industrial equipment operation monitoring anomaly detection method and system based on a multi-layer dynamic graph, and is applied to the technical field of multi-dimensional time series analysis.The application comprises the following steps: obtaining a multi-dimensional time series, splitting the multi-dimensional time series, extracting features to obtain a dimension portrait of each window scale of each dimension variable, aggregating to obtain a global portrait, selecting a multi-scale composition strategy and fusion configuration in a preset strategy library; calculating node features of each dimension, strengthening the correlation relationship to obtain an intra-layer dynamic graph structure, constructing an inter-layer edge to obtain a multi-layer dynamic graph structure; performing intra-layer feature propagation and cross-layer information fusion on the multi-layer dynamic graph structure based on the multi-scale composition strategy and the fusion configuration, and outputting feature representation, performing time series modeling and reconstruction to obtain a reconstructed sequence; and calculating an anomaly score of the reconstructed sequence, comparing the anomaly score with an optimal threshold value obtained through training, and outputting an anomaly detection result.The application fully depicts the dynamic evolution and multi-time scale features of variable correlation in a multi-dimensional time series.

Description

Technical Field

[0001] This invention relates to the field of multidimensional time series analysis technology, and in particular to a method and system for detecting anomalies in industrial equipment operation monitoring based on multi-layer dynamic graphs. Background Technology

[0002] In industrial production, information system operation and maintenance, and complex sensor networks, multidimensional time-series data composed of multiple monitored variables are frequently generated. Due to factors such as operating condition switching, load fluctuations, component aging, external disturbances, or communication anomalies, various anomalies may appear in the data, including sudden changes, drift, periodic distortion, and intermittent anomalies. If anomalies are not detected and located in a timely manner, it often leads to performance degradation, fault expansion, or increased maintenance costs. Therefore, accurate and stable anomaly detection of multidimensional time series data is of great significance.

[0003] Existing anomaly detection methods often rely on fixed features or prior distribution assumptions, making them ill-suited for the nonlinear and non-stationary data changes in complex systems. While some deep learning methods can learn time dependencies, in multidimensional variable scenarios, they tend to simplify variable relationships to static correlation structures or fixed adjacency relationships, failing to characterize the dynamic evolution of correlations between variables over time windows. This can lead to false positives and false negatives in scenarios with frequent changes in operating conditions or rapid changes in correlation structures. Furthermore, multidimensional time series simultaneously contain short-term fluctuation patterns and local trend patterns over longer time scales. Even when multi-scale modeling is introduced, existing methods often remain at the level of extracting data from different window scales in parallel and then performing simple weighted fusion, lacking a joint modeling mechanism for the variable relationship graph structure at different time granularities. This can result in conflicting correlation structures learned at different scales, leading to unstable detection results and insufficient generalization ability.

[0004] Therefore, there is an urgent need to develop a method and system for detecting anomalies in industrial equipment operation based on multi-layer dynamic graphs to solve the above problems. Summary of the Invention

[0005] This invention provides a method and system for detecting anomalies in industrial equipment operation monitoring based on multi-layer dynamic graphs, which solves the above-mentioned problems and addresses issues such as unstable detection results, low accuracy, and insufficient generalization ability in existing anomaly detection methods.

[0006] According to a first aspect of the present invention, a method for detecting anomalies in the operation of industrial equipment based on multi-layer dynamic graphs is provided. The method includes: Obtain continuously sampled multidimensional time series and perform preprocessing; The preprocessed multi-dimensional time series is segmented using several different window scales and corresponding sliding step sizes, and feature extraction is performed to obtain dimensional profiles of each dimensional variable under each window scale. The dimensional profiles are aggregated to obtain a global profile. Based on the global profile, a multi-scale mapping strategy and fusion configuration that are updated with the window are dynamically selected from a preset strategy library. For each sliding window at each time granularity, the node features corresponding to each dimension variable are calculated. The correlation is strengthened based on the node features at the same time granularity to obtain the intra-layer dynamic graph structure at the corresponding time granularity. Inter-layer edges are constructed based on the node features of the same dimension variable in different layers to obtain a multi-layer dynamic graph structure. Based on the multi-scale graphing strategy and fusion configuration, intra-layer feature propagation and cross-layer information fusion are performed on the multi-layer dynamic graph structure. Joint learning is then performed to output a feature representation that integrates multi-layer dependency information. Temporal modeling and reconstruction are then performed based on the feature representation to obtain a reconstructed sequence. The reconstruction error of the reconstructed sequence is calculated, an anomaly score is calculated based on the reconstruction error, and the anomaly detection result is output by comparing it with the optimal threshold obtained during training.

[0007] Furthermore, the dimensional profile includes dimensional types and cross-scale dynamic features; The dimension types include physical continuous quantities, percentage index quantities, and state discrete quantities; The cross-scale dynamic feature vector is obtained by concatenating the window mean, trend feature and burst rate feature at each window scale according to the window scale.

[0008] Furthermore, based on the global profile, a multi-scale mapping strategy and fusion configuration that updates with the window are dynamically selected from a preset strategy library, including: The constructed strategy selector calculates the selection weight of each strategy in the preset strategy library based on the global profile; Select the strategy with the largest strategy weight and calculate the corresponding selection confidence. Determine whether the selection confidence is greater than the preset confidence. If so, obtain the multi-scale segmentation configuration, allowed time granularity combination, allowed coupling type combination and cross-layer fusion operator type corresponding to the strategy with the largest strategy weight; otherwise, start the default configuration.

[0009] Furthermore, the association relationships are strengthened based on the node features at the same time granularity to obtain the corresponding intra-layer dynamic graph structure at the corresponding time granularity, including the following steps: The scaling dot product is calculated based on the query mapping and key vector corresponding to the node features at the same time granularity to obtain the relevance score; Based on the data type of the dimension variable in the allowed coupling type combination, the corresponding calculation method is selected and the consistency factor is calculated. The correlation score is enhanced using the consistency factor to obtain an enhanced score. All the enhanced scores are then normalized to obtain a dynamic graph adjacency matrix. The top-k sparsity strategy is used to retain the top k edges with the largest edge weights in the adjacency matrix of the dynamic graph, and then normalizes them to obtain the dynamic adjacency matrix and generate the dynamic graph structure within the layer.

[0010] Furthermore, based on the node features of the same dimensional variable in different layers, inter-layer edges are constructed to obtain a multi-layer dynamic graph structure, including: Calculate the cross-layer similarity score of the same dimension variable across different layers; Calculate the volatility and dispersion indices for this dimension variable in each layer; The unnormalized weights of inter-layer edges are calculated based on the cross-layer similarity score, volatility index, and dispersion index. The unnormalized weights are normalized to obtain the inter-layer edge weights and generate a multi-layer dynamic graph structure.

[0011] Furthermore, based on the multi-scale graphing strategy and fusion configuration, intra-layer feature propagation and cross-layer information fusion are performed on the multi-layer dynamic graph structure, and a feature representation fusing multi-layer dependency information is output. Temporal modeling and reconstruction are then performed based on this feature representation to obtain a reconstructed sequence, including: Graph convolution is performed based on the dynamic adjacency matrix of each layer and the corresponding node features to obtain the propagated node feature matrix; Based on the multi-scale composition strategy and the combination of time granularity allowing interaction in the fusion configuration, the inter-layer edge weights between different layers are filtered to obtain the selection weights. The selected weights are normalized to obtain normalized inter-layer weights. Based on the multi-scale mapping strategy and the cross-layer fusion operator type in the fusion configuration, the same dimension variables on different layers are fused to obtain feature representations. The feature representation is modeled in chronological order to obtain the temporal hidden states of each layer. The temporal hidden states are then weighted to obtain a unified hidden state representation. The unified hidden state representation is processed by a reconstruction mapping network to obtain a reconstruction sequence.

[0012] Furthermore, an anomaly score is calculated based on the reconstruction error, and compared with the optimal threshold obtained during training to output the anomaly detection result, including: Feature aggregation is performed on the reconstruction error within each time step, and then temporal aggregation is performed to obtain anomaly scores; The anomaly score is smoothed and compared with the optimal threshold obtained during training to output the anomaly detection result.

[0013] According to a second aspect of the present invention, an industrial equipment operation monitoring anomaly detection system based on multi-layer dynamic graphs is provided, comprising: The acquisition module is used to acquire continuously sampled multidimensional time series data and perform preprocessing. The configuration module, connected to the acquisition module, is used to segment the preprocessed multi-dimensional time series using several different window scales and corresponding sliding steps, and to extract features to obtain dimensional profiles of each dimensional variable under each window scale. The dimensional profiles are aggregated to obtain a global profile. Based on the global profile, a multi-scale mapping strategy and fusion configuration that are updated with the window are dynamically selected from the preset strategy library. The construction module, connected to the configuration module, is used to calculate the node features corresponding to each dimension variable for each sliding window at each time granularity, strengthen the association relationship based on the node features at the same time granularity, obtain the corresponding intra-layer dynamic graph structure at the corresponding time granularity, and construct inter-layer edges based on the node features of the same dimension variable in different layers to obtain a multi-layer dynamic graph structure. The update module, connected to the construction module, is used to perform intra-layer feature propagation and cross-layer information fusion on the multi-layer dynamic graph structure based on the multi-scale graph construction strategy and fusion configuration, and output a feature representation that fuses multi-layer dependency information. Based on the feature representation, temporal modeling and reconstruction are performed to obtain a reconstructed sequence. The judgment module, connected to the update module, is used to calculate the reconstruction error of the reconstructed sequence, calculate the anomaly score based on the reconstruction error, and compare it with the optimal threshold obtained through training to output the anomaly detection result.

[0014] According to a third aspect of the present invention, an electronic device is provided, including a memory, a processor, and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor to implement an industrial equipment operation monitoring anomaly detection method based on a multi-layer dynamic graph.

[0015] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon; the computer program is executed by a processor to implement a method for detecting anomalies in the operation of industrial equipment based on a multi-layer dynamic graph.

[0016] The beneficial effects of this invention are: This invention can characterize local patterns of multidimensional time series at different time scales, improving the coverage of anomalies of different forms; it can adaptively learn the dynamic correlation structure between variables within each window, enhancing its adaptability to changes in operating conditions and the evolution of correlations; it can form more discriminative feature representations through graph feature propagation and multi-scale fusion, reducing false alarms and false negatives; and it can achieve anomaly scoring and detection by reconstructing errors even in the absence of anomaly labels or a shortage of anomaly samples. It has strong engineering practical value and promising prospects for widespread application, and is suitable for intelligent operation and maintenance scenarios such as industrial equipment condition monitoring, server operation monitoring, and various multi-source sensing systems.

[0017] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of the present invention, nor is it intended to restrict the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0018] The above and other features, advantages, and aspects of the various embodiments of the present invention will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the invention. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein: Figure 1 The flowchart illustrates a method for detecting anomalies in industrial equipment operation monitoring based on multi-layer dynamic graphs, as provided in an embodiment of the present invention. Figure 2 A simplified flowchart of an industrial equipment operation monitoring anomaly detection method based on multi-layer dynamic graphs provided by an embodiment of the present invention is shown. Figure 3 This diagram illustrates a framework diagram of an industrial equipment operation monitoring and anomaly detection system based on a multi-layer dynamic graph, according to an embodiment of the present invention. Figure 4 A block diagram of an electronic device according to an embodiment of the present invention is shown. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0021] Based on the above considerations, this invention provides a method for detecting anomalies in industrial equipment operation monitoring based on multi-layer dynamic graphs. (See [link to relevant documentation]). Figure 1 and Figure 2 The method specifically includes the following steps: S1. Obtain the multi-dimensional time series of continuous sampling and perform preprocessing.

[0022] First, a multi-dimensional time series is collected over a continuous period. The data consists of n monitored variables, where n is a natural number greater than 0, meaning there are n dimensional variables in total. The multi-dimensional time series can be denoted as: Where t represents the time index. This represents the observed value of the i-th dimension variable collected at time t. After collection, the data undergoes preprocessing, including cleaning, handling missing values, and standardization, to ensure the comparability of data with different dimensions. Then, it is divided into training, validation, and test sets according to time sequence.

[0023] S2. The preprocessed multi-dimensional time series is segmented using several different window scales and corresponding sliding step sizes, and feature extraction is performed to obtain dimensional profiles of each dimensional variable under each window scale. The dimensional profiles are aggregated to obtain a global profile. Based on the global profile, a multi-scale mapping strategy and fusion configuration that are updated with the window are dynamically selected from the preset strategy library.

[0024] This invention improves the adaptability of multi-scale window segmentation and subsequent composition by generating dimensional profiles and selecting strategies.

[0025] Specifically, dimensional profiling involves generating a profiling vector for each dimensional variable i that is aligned with the end time t of the window. Including dimension types And cross-scale dynamic features; where the dimension types include at least: physical continuous quantities, percentage indicators and state discrete quantities; cross-scale dynamic features are obtained by splicing the window mean, trend features and burst rate features under each window scale according to the scale.

[0026] (1) Dimension type Continuous physical quantities are used to describe continuously changing measured values ​​such as temperature, pressure, speed, and power; percentage indicators are used to describe ratio-type indicators with normalized meaning, such as utilization rate, proportion, and ratio; discrete state quantities are used to describe state variables such as switches, modes, and alarm levels, which take values ​​from a finite set of states. Dimension types satisfy... ,in, denoted as a physical continuous quantity, pct represents a percentage index quantity, and sta represents a state discrete quantity.

[0027] (2) Cross-scale dynamic characteristics Specifically, preset A window scale, such as ,by Let represent the window length at the S-th scale. For any window scale s (where s represents the window index, and different window indices correspond to different window scales) and the time t at the end of the window, define the time series segment of the i-th dimension variable within that window. Expressed using the following formula: ; in, Let S1 represent the time series of the i-th dimension variable obtained after preprocessing. The above steps realize the segmentation operation of the preprocessed multi-dimensional time series.

[0028] To construct the dynamic features of the i-th dimension variable at window scale s, this invention calculates the window mean within different windows as the baseline feature. The window mean feature can be expressed by the following formula: ; in, Let represent the window mean feature of the i-th dimension variable at time t at the end of the window under window size s. Indicates time.

[0029] To characterize the overall direction and intensity of change within a window, this invention introduces a trend feature based on the difference between the beginning and end of the window, used to represent the net magnitude of change at the same window scale, as shown in the following formula: ; in, This indicates the trend of window end alignment at window size s. This represents the difference between the value at the end of the window and the value at the beginning of the window. This indicates the number of steps corresponding to the window scale, used to obtain the normalized average change.

[0030] To characterize the intensity of abrupt changes within a window, this invention introduces a burst rate feature, converting whether the change between adjacent sampling points exceeds a threshold into an event ratio, as detailed in the following formula: ; in, This represents the burst rate of the i-th dimension variable within the window at window size s. Indicates an indicator function, represents the threshold for sudden change discrimination of the i-th dimension variable, used to convert drastic changes within the window into the proportion of statistically significant sudden events; |·| represents taking the absolute value.

[0031] The cross-scale dynamic features are obtained by concatenating the above features, as detailed in the following formula: ; in, This represents the cross-scale dynamic feature vector of the i-th dimension variable. This indicates a splicing operator, where the triples within the square brackets correspond to the window mean, trend feature, and burst rate feature at different window scales, respectively.

[0032] In addition, the generation of dimensional profiles requires the following steps: To inject dimensional type information into the profile representation, a type embedding vector is configured for each type of dimensional variable, and this vector is concatenated with cross-scale dynamic features to obtain the corresponding profile vector: ; in, This represents the image vector of the i-th dimension at time t. Indicates dimension type The corresponding type embedding vector is used to inject the dimensional category information of physical continuous quantities, percentage index quantities and state discrete quantities into the portrait vector representation to obtain dimensional portraits.

[0033] This invention aggregates the profile vectors of each dimension to obtain a global profile, representing the overall picture of the window in terms of variable type composition and dynamic behavior. The global profile is calculated using the following formula: ; in, It provides a global profile for the i-th dimension variable at window time t, which drives the strategy selector to determine the multi-scale mapping strategy and fusion configuration that are updated with the window scale in the preset strategy library. This includes multi-scale segmentation configuration, time granularity combination that allows interaction, type combination that allows coupling, and cross-layer fusion operator type.

[0034] Specifically, the constructed strategy selector calculates the selection weight of each strategy in the preset strategy library based on the global profile; Select the strategy with the largest strategy weight and calculate the corresponding selection confidence. Determine whether the selection confidence is greater than the preset confidence. If so, obtain the multi-scale segmentation configuration, allowed time granularity combination, allowed coupling type combination and cross-layer fusion operator type corresponding to the strategy with the largest strategy weight; otherwise, start the default configuration.

[0035] In one specific embodiment, the preset strategy library is: There are M strategies in total. This represents the configuration of the m-th output multi-scale window set, including parameters such as different window scales, sliding step size, and jump distance within the window; This represents the m-th multi-layered interactive template, consisting of a set of scale pairs that allow interaction. Coupled with allowed types composition; This indicates the type of the m-th fusion operator, used to specify the operator implementation for cross-layer fusion.

[0036] Strategy selector with global profile As input, the output includes the selection weights for each strategy and the selection strategy index. This leads to the multi-scale segmentation configuration that updates with the window. Allowed combination of time granularity for interaction Allowed coupling type combinations With cross-layer fusion operator type .

[0037] For example, the selection weights are calculated using the following formula: ; in, This represents the weight of choosing the m-th strategy at time t. This represents a trainable mapping of the policy selector. Let be the score for the m-th strategy, and let be the normalized sum of all scores.

[0038] Specifically, the confidence level for strategy selection can be calculated using the following formula: ; in, This represents the confidence level of strategy selection, when... When the value is lower than the preset value, the default configuration is activated, including the preset window set. Fully permissible scale layer for templates Fully Allowed Type-Coupled Templates and the default fusion operator This ensures stable execution of multi-scale mapping and fusion even in scenarios with insufficient confidence. This yields a set of effective strategies after threshold filtering.

[0039] In one specific embodiment, multi-scale segmentation configuration It can be represented as: ; in, Let represent the set of window scale indices finally adopted after candidate strategy selection at time t, and For any The corresponding window length is denoted as The window sliding step size is denoted as The sampling jump distance within the window is denoted as Regarding window size With the end of the window at time t, when The time window is obtained by continuous sampling. ;when Time window sampling intercept obtained by jump distance And the time intervals at the ends of adjacent windows are determined by step size. The subsequent samples are generated by moving forward.

[0040] ; Among them, when When corresponding to a continuous sampling window, when The corresponding jump distance sampling window is determined by the sliding step size at the end of the adjacent window. Subsequent samples are generated by moving the data forward. Multiple sets of subsequence samples are obtained through a multi-scale sliding window, thereby simultaneously covering patterns at different time granularities, such as short-term fluctuations and longer-term trends.

[0041] S3. For each sliding window at each time granularity, calculate the node features corresponding to each dimension variable, strengthen the association based on the node features at the same time granularity, obtain the corresponding intra-layer dynamic graph structure at the corresponding time granularity, and construct inter-layer edges based on the node features of the same dimension variable in different layers to obtain a multi-layer dynamic graph structure.

[0042] Different window sizes are mapped one-to-one with layers in a multi-layered graph structure, with layer indices as follows: Each layer uses the monitored dimension variables as nodes, and the node set is... .

[0043] Intra-layer edges are constructed within the same layer to characterize the dynamic dependencies of variables across different dimensions at the same window scale. Inter-layer edges are constructed between different layers for nodes of the same variable to characterize the cross-layer coupling relationships of the same variable at different time granularities. Based on the strategy selection results output by S2, an interactive template that changes with the window is obtained, enabling the composition process to dynamically and adaptively adjust with the window.

[0044] This invention defines a type mask. This indicates whether enhancement is allowed for each dimension variable type; see the following formula: ; in, and These represent the types of the i-th and j-th dimensions, respectively.

[0045] For samples with window size s and window end time t For each dimension variable node i, extract the local temporal representation, as shown in the following formula: ; in, This represents the node feature at time t of the i-th dimension variable node under different window scales. This represents the sequence segment corresponding to time t within the window for the i-th dimension variable. Let represent the encoding mapping of the s-th layer, and d represent the total number of node dimensions. This formula encodes the local sequence segment of the i-th dimension variable within the window into a fixed-length vector representation, which is used as the node input feature for subsequent graph construction and propagation.

[0046] This invention uses the following formula to summarize all dimensional variable nodes into a matrix, which facilitates subsequent calculations: ; in, Let represent the node representation matrix of the s-th layer at time t, stacked according to node dimensions to form an n×d matrix. This indicates transpose.

[0047] Constructing a multi-layered dynamic graph structure includes the following steps: (a) In terms of layer-by-layer edge construction The scaling dot product is calculated based on the query mapping and key vector corresponding to the node features at the same time granularity to obtain the relevance score; Based on the data type of the dimension variable in the allowed coupling type combination, the corresponding calculation method is selected and the consistency factor is calculated. The correlation score is enhanced using the consistency factor to obtain an enhanced score. All the enhanced scores are then normalized to obtain a dynamic graph adjacency matrix. The top-k sparsity strategy is used to retain the top k edges with the largest edge weights in the adjacency matrix of the dynamic graph, and then normalized to obtain the dynamic graph structure within the layer.

[0048] Specifically, see the following steps: Based on node features, the query vector and key vector of the s-th layer are represented by the following formulas: ; in, This represents the query vector at level s. Represents the key vector of the s-th layer. and All of these represent trainable parameters.

[0049] By calculating the query vector and key vector, the node representation is projected onto the attention space, which facilitates the subsequent calculation of the relevance weights between nodes.

[0050] To accurately determine the true dynamic relationships between variables of different types and dimensions at the same time granularity and optimize the calculation of edge weights in the dynamic graph within a layer, this invention introduces a collaborative consistency factor. And based on the type of the dimension variable, different consistency calculation methods are used for calculations that satisfy the allowed coupling type combinations: (1) When the dimensional variable is a physically continuous quantity, consider lag coupling and use the maximum lag correlation within the window to measure consistency, see the following formula: ; in, This represents the consistency factor for the physical continuous quantity dimension type pairs under window scale s, that is, the consistency factor between the i-th and j-th dimension variable types. Indicates the maximum lag order. Indicates the lag quantity. and These represent the window sequence segments between the i-th and j-th dimension variables at end-alignment time t under window scale s. This indicates that the sequence within the window is shifted and aligned by a hysteresis. This represents the correlation calculation operator.

[0051] (2) When the dimensional variable is a percentage indicator, consider synchronous peaks or synchronous fluctuations. First, consider the moment when the difference between adjacent variables exceeds the threshold as a sudden event, and use the Jaccard coefficient of sudden event co-occurrence to measure consistency. See the following formula for details: ; in, The consistency factor represents the percentage indicator type pair under window scale s. This represents the position of the vector of dimension i within the window. The sudden event indicator at a given time, with the numerator representing the number of co-occurrences and the denominator representing the number of unions, is used to characterize the synchronous sudden synergy of percentage indicators within a window.

[0052] (3) When the dimensional variable is a discrete state variable, consider the state dependency and linkage relationship, and use mutual information to measure consistency. The mutual information can be estimated based on the empirical distribution of the discrete state sequence, see the following formula: ; in, The consistency factor represents the pair of discrete state types at scale s. Represents the mutual information computation operator, and These are the corresponding discrete state window sequence segments.

[0053] The enhanced score is calculated based on the above consistency calculation results, specifically including the following steps: The correlation score from node i to node j is calculated using a scaled dot product with a scaling factor. See the following formula: ; Where d represents the vector dimension, This represents the correlation score between node i and node j at time t under a window scale s. This formula calculates the correlation score between any two nodes; a higher score indicates a stronger dependency.

[0054] To unify different types of consistency into the layer edge computation, this invention sets... To and The matching consistency factor output is used to enhance the base score under type mask constraints, resulting in an enhanced score. .

[0055] ; in, This represents the augmented score between node pairs (i,j) at window scale s. Indicates the enhancement coefficient. Indicates the type mask.

[0056] This invention introduces prior knowledge from the domain to make graph structure learning more closely aligned with the physical connections and logical associations of different data types.

[0057] Normalizing the augmented scores yields the elements of the dynamic graph adjacency matrix: ; in, Let represent the adjacency matrix element at time t under window scale s, in the i-th row and j-th column. Let i represent an exponential function such that the sum of the row weights for a fixed i is 1.

[0058] This invention transforms enhanced scoring into probabilistic edge weights, resulting in a window-level dynamic graph adjacency matrix. This converts the association relationships into a stable probability distribution, facilitating subsequent graph feature propagation.

[0059] To preserve key related edges and reduce the impact of noise, in one specific embodiment, a Top-k sparsity strategy is used to retain the k edges with the highest weights in each row of the adjacency matrix of the dynamic graph, and then re-normalize them, as shown in the following formula: ; in, Represents a dynamic adjacency matrix. This means selecting the set of the k positions with the largest weights, i.e., retaining the k edges with the largest edge weights in the adjacency matrix of the dynamic graph, and setting the weights of the other positions to zero. Let i represent the vector in the i-th row, and otherwise represent the case where the vector is not in the TopK set. This indicates the row-normalization operator. This represents a dynamic graph sequence, used to characterize the dynamic evolution of variable correlations over time.

[0060] The above formula preserves key dependent edges and suppresses noisy edges through sparsification, and then ensures numerical stability during propagation through row normalization. This results in a dynamic graph sequence that updates with the sliding window, dynamically reflecting the evolution of the association relationship.

[0061] (ii) In terms of interlayer edge construction Calculate the cross-layer similarity score of the same dimension variable across different layers; Calculate the volatility and dispersion indices for this dimension variable in each layer; The unnormalized weights of inter-layer edges are calculated based on the cross-layer similarity score, volatility index, and dispersion index. The unnormalized weights are normalized to obtain the inter-layer edge weights and generate a multi-layer dynamic graph structure.

[0062] Specifically, it includes the following steps: For node i with the same dimension variable, establish inter-layer edges between different layers, and construct the inter-layer edge weights from layer v to layer u.

[0063] First, calculate the cross-layer representation similarity term, as shown in the following formula: ; in, Indicates the source layer index (or source layer for short). Indicates the index of the target layer (or simply the target layer). This represents the cross-layer similarity score of the dimension variable node i from the source layer v to the target layer u. and These represent the trainable parameters for the target layer query mapping and the source layer key mapping, respectively.

[0064] The above formula measures the similarity of representations of the same dimension variable across different layers, and is used to construct the cross-layer coupling strength. However, using similarity alone to represent similarity is insufficient. This invention introduces volatility and dispersion indices to reflect the differences in contribution at different time granularities.

[0065] The volatility index is expressed by the following formula: ; in, This represents the average difference magnitude between adjacent values ​​of the dimension variable node i within a window of size s, used to characterize the degree of local fluctuation. Indicates the time within the window The value of the i-th dimension variable.

[0066] The above formula uses the first-order difference magnitude of the sequence to characterize the strength of local fluctuations, providing a statistical basis for cross-layer weights.

[0067] The dispersion index is expressed by the following formula: ; in, The dispersion index is the relative mean of node i of dimension variable within a window of size s. The mean squared deviation is used to characterize the overall dispersion of the variable within the window; Represents the time within the window at time t with window size s. The value of the i-th variable at time , .

[0068] The dispersion index, using the mean square deviation of samples within a window relative to the mean, characterizes the overall dispersion of the variable at that scale. It provides a complementary statistical basis for cross-scale weights to the volatility index, thereby enhancing the stability and discriminative power of cross-scale coupling weights. This invention, by calculating the volatility and dispersion indices, leverages the statistical characteristics of the data itself to provide supplementary evidence for cross-scale connections, making the connection weights more robust.

[0069] The unnormalized weights of inter-layer edges are obtained by jointly calculating cross-layer similarity scores, volatility indices, and dispersion indices. ; in, For unnormalized inter-layer weights, and These represent the weighting coefficients used to balance the contributions of the volatility and dispersion terms, respectively.

[0070] This invention combines similarity representation with statistical features to form a more robust cross-layer connection strength.

[0071] For a fixed target layer u, normalize across all source layer dimensions to obtain inter-layer edge weights aligned in the same dimension, as shown in the following formula: ; in, This represents the normalized inter-layer edge weights. The denominator is summed over all source layers to form a cross-layer softmax normalization, thus obtaining the dynamic inter-layer graph edge weights that update with the window. It is used to characterize the cross-layer coupling channels of the same variable at different time granularities.

[0072] S4. Based on the multi-scale graphing strategy and fusion configuration, perform intra-layer feature propagation and cross-layer information fusion on the multi-layer dynamic graph structure, and output a feature representation that fuses multi-layer dependency information. Based on the feature representation, perform temporal modeling and reconstruction to obtain a reconstructed sequence. The training processes S2 and S3 are implemented based on the partitioned training set to update network parameters. Hyperparameters and early stopping are selected based on the validation set to determine adaptive parameters or quantiles for anomaly detection thresholds. Specifically, graph convolution is performed based on the dynamic adjacency matrix of each layer and the corresponding node features to obtain the propagated node feature matrix. Based on the multi-scale composition strategy and the combination of time granularity allowing interaction in the fusion configuration, the inter-layer edge weights between different layers are filtered to obtain the selection weights. The selected weights are normalized to obtain normalized inter-layer weights. Based on the multi-scale mapping strategy and the cross-layer fusion operator type in the fusion configuration, the same dimension variables on different layers are fused to obtain feature representations. The feature representation is modeled in chronological order to obtain the temporal hidden states of each layer. The temporal hidden states are then weighted to obtain a unified hidden state representation. The unified hidden state representation is processed by a reconstruction mapping network to obtain a reconstruction sequence.

[0073] In one embodiment, the following steps are specifically included: Regarding intra-layer propagation, for the s-th layer based on Aggregation yields: ; in, This represents the node feature matrix after propagation within the layer. and All of these represent trainable parameters. This represents a non-linear activation function.

[0074] The above formulas achieve adjacency aggregation and linear transformation within the same scale layer, enabling node features to propagate along the edges of the dynamic graph within the layer, aggregating neighbor information, and thus capturing the dynamic correlation features between variables at the current time granularity.

[0075] Before inter-layer fusion, apply scale layer template constraints to cross-layer weights, allowing only... Cross-layer channels participate in the fusion calculation, see the following formula: ; in, This represents the inter-layer weights after applying the scale layer to the constraints, i.e., the selection weights. This indicates the indicator function. By filtering the weights of inter-layer edges, dynamic configuration of cross-layer connection modes is achieved, allowing information exchange only between preset, meaningful scale combinations.

[0076] To avoid weight imbalance caused by template clipping, the selected weights are normalized to obtain normalized inter-layer weights used for fusion calculation. See the following formula: ; in, The denominator represents the normalized inter-layer weights, and the summation is applied to all source layers for the same target layer u. This indicates a stable term to avoid the denominator being zero.

[0077] Interlayer fusion is identified by the fusion operator. Specify, and through a unified interface Different fusion implementations are encapsulated, meaning they are called from the same function entry point, and internally switched based on the fusion operator identifier. Let... Let represent the intra-layer propagation representation of node i at window scale s. Then, the cross-layer fusion output of node i at the target layer u, i.e., the feature representation, is denoted as . Its calculation is by The specified operator implementation.

[0078] (1) When When Gate fusion (i.e., gated injection) is specified, cross-layer information is superimposed onto the target layer node features using gated injection, as shown in the following formula: ; in, Representation of features, This represents the target layer input representation. Indicates cross-layer mapping parameters, This represents element-wise multiplication. This represents the inter-layer weights after template constraints and renormalization.

[0079] (2) When When specified as Attn fusion (attention-weighted), attention scores are first calculated within the cross-layer channel, and then combined. Normalization is performed to obtain the cross-layer attention weights, as shown in the following formula: ; in, This indicates cross-level attention scoring. Indicates the target layer query mapping parameters. d represents the source layer key mapping parameter, and d represents the feature dimension.

[0080] ; in, This represents the cross-layer attention weights. The numerator consists of the attention scoring index and the template constraint weights, while the denominator is normalized over all source layers to ensure that the weights are adaptively distributed within the set of template-allowed channels.

[0081] ; in, 'Indicates the Attn feature representation.

[0082] (3) When When specified as Concat fusion (i.e., concatenation mapping), the target layer representation is concatenated with the weighted mapping representations of each source layer, and the feature representation is obtained through a trainable mapping. See the following steps for details: ; in, This indicates concatenating intermediate vectors.

[0083] ; in, This represents the Concat feature representation. This represents the fusion mapping parameter, used to project the concatenated vector onto the feature dimension space of the target layer.

[0084] ; in, This represents the node feature matrix after the target layer u has completed the Concat fusion. express.

[0085] The above process stacks the node-level fusion results into a matrix, fusing information representing the same variable captured at different time granularities to form a node representation that simultaneously contains multi-scale dependencies.

[0086] In terms of temporal modeling and reconstruction, the feature representation of each layer... The hidden state is obtained by performing time-series modeling: ; in, This represents the temporal hidden state of the l-th layer. This indicates the hidden state at the previous moment. This indicates the gating loop unit update operator.

[0087] The above formula performs temporal modeling on the fused graph features at each scale layer, extracts temporal dependencies to support reconstruction, and performs gated weighting on the outputs of each layer to obtain a unified fused representation, as shown in the following formula: ; in, Indicates the scale-gated weights. Represents the trainable scale weight parameters, and the denominator is a pair. Summing is used to form softmax normalization.

[0088] ; in, This represents the unified hidden state representation after cross-scale fusion.

[0089] By fusing the temporal hidden states of each scale according to the gating weights using the above formula, a unified representation for decoding and reconstruction is obtained.

[0090] Mapping the unified hidden state representation to a window reconstruction sequence, see the following formula: ; in, This represents the reconstruction sequence, and W represents the length of the output reconstruction window. The reconstruction mapping network is represented by a unified hidden state representation that is decoded back into the input space to generate a reconstruction sequence aligned with the window.

[0091] To avoid conflicts between graph structures learned from different layers, this invention introduces an inter-layer structural consistency constraint term. See the following formula: ; in, This represents the inter-layer alignment mapping operator. This represents the sum of the absolute values ​​of the elements. Consistency constraints are used to constrain adjacent scale layers. and +1 to the intra-layer adjacency matrix in the alignment mapping This ensures that the graph structures learned at different time scales are comparable and consistent within a unified alignment space.

[0092] Regarding the training objectives, the model training primarily aims to correct the reconstruction error, and incorporates intra-layer sparse regularization and inter-layer consistency constraints L. ; Where T represents the number of training windows, Denotes the Frobenius norm. and All of these represent trade-off coefficients.

[0093] S5. Calculate the reconstruction error of the reconstructed sequence, calculate the anomaly score based on the reconstruction error, and compare it with the optimal threshold obtained during training to output the anomaly detection result; In step S5, firstly, feature aggregation is performed on the reconstruction error within each time step, and temporal aggregation is then performed to obtain an anomaly score. Next, the anomaly score is smoothed and compared with the optimal threshold obtained through training to output the anomaly detection result. Specifically, this includes the following steps: First, calculate the window-level element-by-element reconstruction error: ; in, Indicates time The reconstruction error of dimension variable i over time. The error tensor is used to measure the reconstruction deviation; the larger the error, the more abnormal the position.

[0094] This invention employs dual-branch aggregation to aggregate along the feature dimension in order to balance the influence of various anomalies. Specifically, it uses dual-branch aggregation and learnable fusion, including a mean branch and a TopK feature branch.

[0095] (1) The mean branch is shown in the following formula: ; in, Indicates time The characteristic mean error at that time.

[0096] (2) In the TopK branch of the feature, let ; in, Indicates the number of TopK features. ∈(0,1] represents the proportion of TopK features. The function represents the floor operator, and max(·) represents the maximum value, which guarantees that at least one value will be selected.

[0097] ; in, This indicates taking the largest value among the reconstructed error vectors. The set obtained from the data This represents the position of the TopK branch of the feature at time t at the end of the window. The aggregation error is averaged to highlight the large errors of a few variables and improve the sensitivity to local strong anomalies.

[0098] By fusing the outputs of the two branches using learnable weights, the time-step error sequence is obtained, as shown in the following formula: ; in, This represents the weight vector for the two-branch fusion. This represents a vector of trainable parameters.

[0099] ; in, and These represent the weights of the two branches, respectively. This equation yields a unified time-step error sequence, providing input for time-dimensional aggregation.

[0100] In terms of time-dimensional aggregation, a five-branch aggregation method is adopted and learnable fusion is performed. The five time-dimensional pooling operators are time mean pooling, time max pooling, time TopK mean pooling, time softmax pooling, and end-value pooling.

[0101] Among them, time mean pooling is used to characterize the overall error level of the window; time max pooling is used to characterize the instantaneous peak error within the window; time TopK mean pooling is used to characterize the average level of several high error time steps within the window; time softmax pooling is used to weight and emphasize high error time steps under differentiable conditions; and end value pooling is used to take the error of the end time step of the window to align with the end label or end decision scenario.

[0102] Time-mean pooling results See the following formula: ; Time-based max pooling results See the following formula: ; In time-based TopK mean pooling, let ,in, This indicates the number of TopK times. This represents the proportion of the Top K values ​​over time. Therefore: ; in, This indicates taking the largest value in the time error series. A set of time steps This represents the time-dimensional aggregated error score obtained from the TopK mean pooling over time.

[0103] In time-based softmax pooling, the temperature parameter is set as follows: ; Where β>0 represents the temperature parameter, θ represents the trainable parameter, and softplus(·) represents the positive value mapping function, satisfying the following formula: ; in, This represents the time weights of the temporal softmax pooling. This represents the time index for normalized summation.

[0104] ; The result of end-point pooling is: .

[0105] Finally, the five branches are fused to obtain the window-level anomaly score, which is then... ; in, The five-branch fusion weight vector, If the parameter vector is trainable, then: ; in, , , , , These represent the weights of the mean pooling branch, max pooling branch, time TopK mean pooling branch, softmax pooling branch, and terminal error branch in the final time aggregated score, respectively.

[0106] Regarding smoothing and threshold determination, for fractional sequences For learnable one-dimensional smoothing, see the following formula: ; Where ρ represents the smoothing kernel weight vector, and φ represents the trainable parameter vector. The aforementioned formula learns a smoothing kernel to suppress score jitter.

[0107] ; in, This represents the smoothed fraction. This represents the relative displacement index, and d represents the smoothing radius. This indicates the corresponding weight, and the scores of adjacent windows are weighted and averaged to improve the stability of the judgment.

[0108] The threshold is learned automatically through model training. Let the quantile be p, then: ; Where δ represents the optimal threshold. Describes the quantile operator. This represents the optimal quantile that is dynamically adjusted during training. A set of predefined threshold ratios is set, and an optimal threshold is automatically learned through the training process. When it is determined that there is an anomaly at time t, It was determined to be normal at that time.

[0109] To verify the effectiveness of the method of this invention, comparative experiments were conducted with various multidimensional time series anomaly detection methods based on a test set. Precision, recall, and F1 score were used as evaluation metrics. The experimental results are shown in Table 1. The method of this invention achieves superior overall detection performance on multiple datasets, effectively characterizing the dynamic evolution of multi-scale local features and variable correlations, thereby improving the performance of multidimensional time series anomaly detection.

[0110] To verify the effectiveness and generalization ability of the method of this invention in different application scenarios, comparative experiments were conducted using three representative multidimensional time series anomaly detection datasets, denoted as WTD, SMD, and PSM. The WTD dataset originates from a wind turbine operation monitoring scenario and includes continuous sampling sequences of multiple sensor variables and corresponding anomaly events. The SMD dataset originates from a server / equipment operation monitoring scenario, recording multidimensional operation index sequences of multiple machines and including anomaly annotations. The PSM dataset originates from an industrial process monitoring scenario and includes continuous observation sequences of multivariate process signals and anomaly annotations. The three datasets differ in variable dimensions, sequence length, and anomaly morphology, and are used to comprehensively verify the anomaly detection performance of the method of this invention on data of different scales and dynamic correlation structures.

[0111] Table 1. Performance comparison of the method of the present invention with different methods ; In Table 1, the model constructed by the method of the present invention represents the anomaly detection method based on multi-scale sliding window and dynamic graph modeling described in the present invention; MTAD-GAT, STGAT, ATCN, and GDN represent multi-dimensional time series anomaly detection methods used for comparison; P(%) represents precision, R(%) represents recall, and F1 represents the harmonic mean of precision and recall.

[0112] Clearly, the model constructed by the method of this invention achieves superior overall detection performance on the WTD, SMD, and PSM datasets, especially outperforming the comparison methods in the F1 score. This indicates that the method of this invention can simultaneously characterize the dynamic evolution of multi-scale local features and variable correlations, thereby improving the accuracy of anomaly detection and reducing false positives and false negatives.

[0113] Based on the above technical solutions, the present invention has the following advantages: This invention can characterize local patterns of multidimensional time series at different time scales, improving the coverage of anomalies of different forms; it can adaptively learn the dynamic correlation structure between variables within each window, enhancing its adaptability to changes in operating conditions and the evolution of correlations; it can form more discriminative feature representations through graph feature propagation and multi-scale fusion, reducing false alarms and false negatives; and it can achieve anomaly scoring and detection by reconstructing errors even in the absence of anomaly labels or a shortage of anomaly samples. It has strong engineering practical value and promising prospects for widespread application, and is suitable for intelligent operation and maintenance scenarios such as industrial equipment condition monitoring, server operation monitoring, and various multi-source sensing systems.

[0114] It should be noted that, for the sake of simplicity, the foregoing embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0115] The acquisition, storage, and application of user personal information involved in the technical solution of this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0116] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the described module can be referred to the corresponding process in the foregoing embodiments, and will not be repeated here.

[0117] This invention also provides an industrial equipment operation monitoring and anomaly detection system 300 based on multi-layer dynamic graphs, see [link to relevant documentation]. Figure 3 Specifically, it includes: The acquisition module 310 is used to acquire continuously sampled multidimensional time series and perform preprocessing; The configuration module 320, connected to the acquisition module 310, is used to segment the preprocessed multi-dimensional time series using several different window scales and corresponding sliding step sizes, and to extract features to obtain dimensional profiles of each dimensional variable under each window scale. The dimensional profiles are aggregated to obtain a global profile. Based on the global profile, a multi-scale mapping strategy and fusion configuration that are updated with the window are dynamically selected from the preset strategy library. The construction module 330, connected to the configuration module 320, is used to calculate the node features corresponding to each dimension variable for each sliding window at each time granularity, strengthen the association relationship based on the node features at the same time granularity, obtain the corresponding intra-layer dynamic graph structure at the corresponding time granularity, and construct inter-layer edges based on the node features of the same dimension variable in different layers to obtain a multi-layer dynamic graph structure. The update module 340, connected to the construction module 330, is used to perform intra-layer feature propagation and cross-layer information fusion on the multi-layer dynamic graph structure based on the multi-scale graph construction strategy and fusion configuration, and output a feature representation that fuses multi-layer dependency information. Based on the feature representation, temporal modeling and reconstruction are performed to obtain a reconstructed sequence. The judgment module 350, connected to the update module 340, is used to calculate the reconstruction error of the reconstructed sequence, calculate the anomaly score based on the reconstruction error, and compare it with the optimal threshold obtained through training to output the anomaly detection result.

[0118] Please refer to the previous methods for other details, which will not be repeated here.

[0119] Figure 4 A schematic block diagram of an electronic device 400 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0120] Electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in ROM 402 or a computer program loaded into RAM 403 from storage unit 408. RAM 403 can also store various programs and data required for the operation of electronic device 400. The computing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. I / O interface 405 is also connected to bus 404.

[0121] Multiple components in electronic device 400 are connected to I / O interface 405, including: input unit 405, such as keyboard, mouse, etc.; output unit 407, such as various types of monitors, speakers, etc.; storage unit 408, such as disk, optical disk, etc.; and communication unit 409, such as network card, modem, wireless transceiver, etc. Communication unit 409 allows electronic device 400 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0122] The computing unit 401 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 401 performs the various processes described above. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via ROM 402 and / or communication unit 409.

[0123] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] The program code used to implement the embodiments of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0125] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0126] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0127] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting anomalies in industrial equipment operation monitoring based on multi-layer dynamic graphs, characterized in that, Includes the following steps: The process of acquiring multi-dimensional time series data collected by monitoring sensors during industrial equipment status monitoring, server operation monitoring, or intelligent operation and maintenance of multi-source sensing systems includes continuous sampling sequences collected by at least one of temperature sensors, pressure sensors, speed sensors, and power sensors, and then preprocessing them. The preprocessed multi-dimensional time series is segmented using several different window scales and corresponding sliding step sizes, and feature extraction is performed to obtain dimensional profiles for each dimensional variable at each window scale. These dimensional profiles are then aggregated to obtain a global profile. Based on this global profile, a multi-scale mapping strategy and fusion configuration that updates with the window size are dynamically selected from a preset strategy library. The dimensional profile includes dimensional type and cross-scale dynamic features. The dimensional type includes physical continuous quantities, percentage indicators, and state discrete quantities used to describe continuously changing measurements. The dimensional variables corresponding to the physical continuous quantities include at least one of temperature, pressure, rotational speed, and power values. The cross-scale dynamic feature vector is obtained by concatenating the window mean, trend features, and burst rate features at each window scale according to the window scale. For each sliding window at each time granularity, the node features corresponding to each dimension variable are calculated. The correlation is strengthened based on the node features at the same time granularity to obtain the corresponding intra-layer dynamic graph structure at the time granularity. Inter-layer edges are constructed based on the node features of the same dimension variable in different layers to obtain a multi-layer dynamic graph structure. In the process of strengthening the correlation, the corresponding consistency factor calculation method is selected according to the dimension type. The maximum lag correlation is used to measure consistency between the physical continuous quantity window sequence segments. The Jaccard coefficient of sudden event co-occurrence is used to measure consistency for the percentage index. The mutual information is used to measure consistency for the state discrete quantity. Based on the multi-scale graphing strategy and fusion configuration, intra-layer feature propagation and cross-layer information fusion are performed on the multi-layer dynamic graph structure, and a feature representation that integrates multi-layer dependency information is output. Temporal modeling and reconstruction are performed based on the feature representation to obtain a reconstructed sequence. The reconstruction error of the reconstructed sequence is calculated, an anomaly score is calculated based on the reconstruction error, and the anomaly detection result is output by comparing it with the optimal threshold obtained by training. The anomaly detection result is used to identify abnormal status of industrial equipment, abnormal operation of servers, or abnormal intelligent operation and maintenance of multi-source sensing systems.

2. The method for detecting anomalies in industrial equipment operation based on multi-layer dynamic graphs according to claim 1, characterized in that, Based on the global profile, dynamically select multi-scale mapping strategies and fusion configurations that update with the window from a preset strategy library, including: The constructed strategy selector calculates the selection weight of each strategy in the preset strategy library based on the global profile; Select the strategy with the largest strategy weight and calculate the corresponding selection confidence. Determine whether the selection confidence is greater than the preset confidence. If so, obtain the multi-scale segmentation configuration, allowed time granularity combination, allowed coupling type combination and cross-layer fusion operator type corresponding to the strategy with the largest strategy weight; otherwise, start the default configuration.

3. The method for detecting anomalies in industrial equipment operation based on multi-layer dynamic graphs according to claim 2, characterized in that, Strengthening relationships based on node features at the same time granularity yields the corresponding intra-layer dynamic graph structure at the same time granularity, including the following steps: The scaling dot product is calculated based on the query mapping and key vector corresponding to the node features at the same time granularity to obtain the relevance score; Based on the data type of the dimension variable in the allowed coupling type combination, the corresponding calculation method is selected and the consistency factor is calculated. The correlation score is enhanced using the consistency factor to obtain an enhanced score. All the enhanced scores are then normalized to obtain a dynamic graph adjacency matrix. The top-k sparsity strategy is used to retain the top k edges with the largest edge weights in the adjacency matrix of the dynamic graph, and then normalizes them to obtain the dynamic adjacency matrix and generate the dynamic graph structure within the layer.

4. The method for detecting anomalies in industrial equipment operation based on multi-layer dynamic graphs according to claim 3, characterized in that, By constructing inter-layer edges based on node features of the same dimensional variable across different layers, a multi-layer dynamic graph structure is obtained, including: Calculate the cross-layer similarity score of the same dimension variable across different layers; Calculate the volatility and dispersion indices for this dimension variable in each layer; The unnormalized weights of inter-layer edges are calculated based on the cross-layer similarity score, volatility index, and dispersion index. The unnormalized weights are normalized to obtain the inter-layer edge weights and generate a multi-layer dynamic graph structure.

5. The method for detecting anomalies in industrial equipment operation based on multi-layer dynamic graphs according to claim 4, characterized in that, Based on the multi-scale graphing strategy and fusion configuration, intra-layer feature propagation and cross-layer information fusion are performed on the multi-layer dynamic graph structure, and a feature representation integrating multi-layer dependency information is output. Temporal modeling and reconstruction are then performed based on this feature representation to obtain a reconstructed sequence, including: Graph convolution is performed based on the dynamic adjacency matrix of each layer and the corresponding node features to obtain the propagated node feature matrix; Based on the multi-scale composition strategy and the combination of time granularity allowing interaction in the fusion configuration, the inter-layer edge weights between different layers are filtered to obtain the selection weights. The selected weights are normalized to obtain normalized inter-layer weights. Based on the multi-scale mapping strategy and the cross-layer fusion operator type in the fusion configuration, the same dimension variables on different layers are fused to obtain feature representations. The feature representation is modeled in chronological order to obtain the temporal hidden states of each layer. The temporal hidden states are then weighted to obtain a unified hidden state representation. The unified hidden state representation is processed by a reconstruction mapping network to obtain a reconstruction sequence.

6. The method for detecting anomalies in industrial equipment operation monitoring based on multi-layer dynamic graphs according to claim 1, characterized in that, An anomaly score is calculated based on the reconstruction error, and compared with the optimal threshold obtained during training to output the anomaly detection result, including: Feature aggregation is performed on the reconstruction error within each time step, and then temporal aggregation is performed to obtain anomaly scores; The anomaly score is smoothed and compared with the optimal threshold obtained during training to output the anomaly detection result.

7. An industrial equipment operation monitoring anomaly detection system based on multi-layer dynamic graphs, used to implement the industrial equipment operation monitoring anomaly detection method based on multi-layer dynamic graphs as described in any one of claims 1-6, characterized in that, The system includes: The acquisition module is used to acquire multi-dimensional time series data collected by monitoring sensors during industrial equipment status monitoring, server operation monitoring, or intelligent operation and maintenance of multi-source sensing systems. This includes continuous sampling sequences collected by at least one of the following sensors: temperature sensor, pressure sensor, speed sensor, and power sensor. The acquisition module is then preprocessed. The configuration module, connected to the acquisition module, is used to segment the preprocessed multi-dimensional time series using several different window scales and corresponding sliding steps, and to extract features to obtain dimensional profiles of each dimensional variable under each window scale. The dimensional profiles are aggregated to obtain a global profile. Based on the global profile, a multi-scale mapping strategy and fusion configuration that are updated with the window are dynamically selected from the preset strategy library. The construction module, connected to the configuration module, is used to calculate the node features corresponding to each dimension variable for each sliding window at each time granularity, strengthen the association relationship based on the node features at the same time granularity, obtain the corresponding intra-layer dynamic graph structure at the corresponding time granularity, and construct inter-layer edges based on the node features of the same dimension variable in different layers to obtain a multi-layer dynamic graph structure. The update module, connected to the construction module, is used to perform intra-layer feature propagation and cross-layer information fusion on the multi-layer dynamic graph structure based on the multi-scale graph construction strategy and fusion configuration, and output a feature representation that fuses multi-layer dependency information. Based on the feature representation, temporal modeling and reconstruction are performed to obtain a reconstructed sequence. The judgment module, connected to the update module, is used to calculate the reconstruction error of the reconstructed sequence, calculate the anomaly score based on the reconstruction error, and compare it with the optimal threshold obtained through training to output the anomaly detection result.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor to implement a method for detecting anomalies in industrial equipment operation based on a multi-layer dynamic graph as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It stores a computer program; the computer program is executed by a processor to implement a method for detecting anomalies in industrial equipment operation based on a multi-layer dynamic graph as described in any one of claims 1 to 6.

Images