Multi-view time sequence anomaly detection method and device, equipment and medium

Abstract

The invention discloses a multi-view time sequence anomaly detection method, device and equipment and a medium, and the method comprises the steps: carrying out the preprocessing of collected data, and obtaining an original time sequence set; performing time sequence feature extraction on each time sequence in the original time sequence set to obtain time sequence feature representation; on the basis of statistical attribute information of variables corresponding to all time sequences in the original time sequence set, semantic description is constructed, semantic coding is conducted on the semantic description, and initial statistical semantic feature representation is obtained; semantic association relationship modeling is carried out on the initial statistical semantic feature representation to obtain statistical semantic representation; obtaining a fusion feature set based on the statistical semantic representation; reconstructing the fused feature set to obtain a reconstructed feature set; determining a comprehensive anomaly score based on the reconstruction error, the depth feature score and a multivariable residual analysis index; and based on the comprehensive anomaly score, completing time sequence anomaly discrimination, and outputting a potential fault of the to-be-detected industrial system.

Description

Technical Field

[0001] This invention relates to the field of time series anomaly detection technology, and in particular to multi-view time series anomaly detection methods, devices, equipment and media. Background Technology

[0002] With the rapid development of the Industrial Internet, cybersecurity, and intelligent operation and maintenance, large-scale sensing devices continuously generate high-dimensional, multi-variable, and time-dependent data during operation. This data, with its diverse sources, high sampling frequency, and significant dynamic evolution characteristics, serves as a crucial indicator of system operating status and health. However, in practical applications, due to complex system structures, frequent changes in operating conditions, and a complex and volatile external environment, time-series data often exhibits non-stationary dynamic characteristics, complex intervariate coupling relationships, and varying degrees of noise interference. This means that anomalies are often not manifested as significant numerical shifts, but rather as localized disruptions to the relationships and interaction mechanisms between variables. Specifically, during system operation, the previously stable influence relationships between some variables undergo abnormal changes within a specific time period or under specific conditions, including interruptions in causal relationships, abnormal drifts in influence intensity, and the emergence of abnormal dependencies. If these anomalies are not identified in a timely manner, they can lead to equipment failure, system performance degradation, or even safety incidents, resulting in severe economic losses.

[0003] Time series anomaly detection, a key technology in the monitoring and risk warning of complex systems, aims to learn the normal operating patterns of a system from historical observation data and identify abnormal behaviors that deviate from these patterns. Existing time series anomaly detection methods are mostly based on predictive or reconstructive modeling frameworks, automatically learning local temporal dependencies and relationships between variables through structures such as convolutional neural networks or recurrent neural networks. Some methods further introduce attention mechanisms to enhance the modeling ability for long-range dependencies of sequences, thus improving the accuracy of anomaly detection to some extent.

[0004] While existing time series anomaly detection methods have improved the representation of complex time series to some extent, they still face many challenges. First, current mainstream methods typically rely on numerical features for modeling, lacking explicit modeling of the system's normal operating mechanisms and the stability of interactions between variables. This makes robust anomaly detection difficult under conditions of weak anomalous signals or strong noise interference. Second, some methods attempt to introduce high-level prior information or external knowledge to enhance model expressiveness; however, the introduction of semantic information often lacks causal constraints with numerical dynamics. Cross-modal alignment errors may mask the true anomaly mechanism or even introduce additional semantic noise, interfering with the learning of the original time-series structural features. Finally, existing anomaly detection mechanisms are usually based on a single perspective, such as prediction error or reconstruction error, making it difficult to simultaneously characterize multiple anomaly forms such as temporal dynamic deviations, high-dimensional latent feature anomalies, and cross-variable structural changes. This makes them prone to missed detections in weak or structurally abnormal scenarios, and their application performance in complex real-world scenarios still has room for improvement. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method, apparatus, device, and medium for multi-view time series anomaly detection; On the one hand, a multi-perspective time series anomaly detection method is provided, including: Sensors deployed in the industrial system under test are used to collect multivariate time series data generated during the operation of the industrial system under test. The collected data is preprocessed to obtain a set of original time series data for anomaly detection of the industrial system under test. The multivariate time series includes time series data corresponding to multiple monitoring variables that reflect the system's operating status. The monitoring variables include one or more of process status parameters, system operating performance parameters, or environmental status parameters. Time series features are extracted from each time series in the original time series set to obtain a time series feature representation; Based on the statistical attribute information of the corresponding variables of each time series in the original time series set, a semantic description is constructed, and the semantic description is semantically encoded to obtain an initial statistical semantic feature representation; the semantic association relationship is modeled on the initial statistical semantic feature representation to obtain a statistical semantic representation. Based on the statistical semantic representation, the feature dimensions related to the interaction between variables in the time series feature representation are constrained and strengthened to obtain a fused feature set; the fused feature set is then reconstructed to obtain a reconstructed feature set. Based on the original time series and the reconstructed feature set, the reconstruction error is determined; based on the reconstruction process, a deep feature score is constructed; based on the reconstruction error distribution relationship corresponding to multiple variables, a multivariate residual analysis index is determined; based on the reconstruction error, the deep feature score, and the multivariate residual analysis index, a comprehensive anomaly score is determined; based on the comprehensive anomaly score, time series anomaly discrimination is completed, and the potential faults of the industrial system to be detected are output.

[0006] On the other hand, a multi-view time series anomaly detection system is provided, including: The data acquisition and preprocessing module is configured to: acquire multivariate time series data generated during the operation of the industrial system under test using sensors deployed in the industrial system under test; preprocess the acquired data to obtain a set of original time series data for anomaly detection of the industrial system under test; wherein, the multivariate time series includes time series data corresponding to multiple monitoring variables reflecting the system operating status, and the monitoring variables include one or more of process state parameters, system operating performance parameters, or environmental state parameters; The feature extraction module is configured to extract time series features from each time series in the original time series set to obtain a time series feature representation. The semantic encoding module is configured to: construct a semantic description based on the statistical attribute information of the corresponding variables of each time series in the original time series set, and perform semantic encoding on the semantic description to obtain an initial statistical semantic feature representation; and model the semantic association relationship of the initial statistical semantic feature representation to obtain a statistical semantic representation. The constraint and reinforcement module is configured to: constrain and reinforce the feature dimensions related to the interaction between variables in the time series feature representation based on the statistical semantic representation to obtain a fused feature set; and reconstruct the fused feature set to obtain a reconstructed feature set. The output module is configured to: determine the reconstruction error based on the original time series and the reconstructed feature set; construct a deep feature score based on the reconstruction process; determine the multivariate residual analysis index based on the reconstruction error distribution relationship of multiple variables; determine the comprehensive anomaly score based on the reconstruction error, the deep feature score, and the multivariate residual analysis index; and complete the time series anomaly discrimination based on the comprehensive anomaly score, and output the potential faults of the industrial system to be detected.

[0007] Furthermore, an electronic device is also provided, including: Memory, used for non-transitory storage of computer-readable instructions; and Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the method described in the first aspect above.

[0008] In another aspect, a storage medium is also provided for non-transitory storage of computer-readable instructions, wherein when the non-transitory computer-readable instructions are executed by a computer, the method described in the first aspect is performed.

[0009] In another aspect, a computer program product is also provided, including a computer program that, when run on one or more processors, is used to implement the method described in the first aspect above.

[0010] The above technical solution has the following advantages or beneficial effects: 1. This invention introduces a pre-trained large language model to semantically encode the statistical attributes of time series, explicitly introducing higher-order statistical concepts such as overall trend strength and relative volatility into the time series modeling process. This enables the model to obtain stable statistical semantic guidance before in-depth modeling of time series features, improving the problem that existing methods rely solely on numerical feature modeling and are unable to accurately depict the overall statistical state and its changing patterns of time series. This enhances the ability to perceive anomalies in weak anomaly and noise interference scenarios.

[0011] 2. This invention adopts a dual-path collaborative modeling mechanism of temporal feature path and semantic knowledge path. While maintaining the ability to characterize the local dynamic changes of time series, it realizes the joint modeling of long-range temporal dependencies and cross-variable structural associations, effectively enhancing the overall feature expression ability and structural perception ability of multivariate time series in complex dynamic environments.

[0012] 3. This invention uses a statistical semantic guidance mechanism to constrain the modeling process by selectively and directionally incorporating statistical semantic information as higher-order prior knowledge. This constrains the model's response to changes in system operating state and the interaction between variables, avoiding interference from irrelevant or redundant semantic information in numerical dynamic modeling. This improves the modeling stability and discriminative consistency under non-stationary dynamic and noise-dominated conditions.

[0013] 4. This invention constructs a multi-perspective anomaly scoring mechanism, which comprehensively characterizes abnormal behavior from three complementary perspectives: consistency of time series reconstruction, distribution of potential features, and residuals of cross-variable interaction mechanisms. This enables multi-level discrimination of abnormal system operation status and abnormal collaborative relationships between variables, effectively making up for the problem that single anomaly discrimination strategies are prone to missing detection in weak anomaly and structural anomaly scenarios, and improving the comprehensiveness and reliability of anomaly detection results. Attached Figure Description

[0014] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0015] Figure 1 This is a flowchart of the method in Example 1. Detailed Implementation

[0016] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0017] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0018] All data acquisition in this embodiment is carried out in accordance with laws and regulations and with user consent, and the data is used legally.

[0019] Example 1 This embodiment provides a multi-perspective time series anomaly detection method; like Figure 1 As shown, the multi-view time series anomaly detection method includes: S101: Using sensors deployed in the industrial system to be tested, a multivariate time series generated during the operation of the industrial system to be tested is collected. The collected data is preprocessed to obtain a set of original time series for anomaly detection of the industrial system to be tested. The multivariate time series includes time series data corresponding to multiple monitoring variables that reflect the operating status of the system. The monitoring variables include one or more of process state parameters, system operating performance parameters, or environmental state parameters. S102: Extract time series features from each time series in the original time series set to obtain a time series feature representation; S103: Based on the statistical attribute information of the corresponding variables of each time series in the original time series set, construct a semantic description, and perform semantic encoding on the semantic description to obtain an initial statistical semantic feature representation; perform semantic association modeling on the initial statistical semantic feature representation to obtain a statistical semantic representation; S104: Based on the statistical semantic representation, constrain and strengthen the feature dimensions related to the interaction between variables in the time series feature representation to obtain a fused feature set; reconstruct the fused feature set to obtain a reconstructed feature set; S105: Based on the original time series and the reconstructed feature set, determine the reconstruction error; based on the reconstruction process, construct a deep feature score; based on the reconstruction error distribution relationship corresponding to multiple variables, determine the multivariate residual analysis index; based on the reconstruction error, deep feature score, and multivariate residual analysis index, determine the comprehensive anomaly score; based on the comprehensive anomaly score, complete the time series anomaly discrimination and output the potential faults of the industrial system to be detected.

[0020] The industrial system to be tested can be an engine. The multivariate time series includes the engine's temperature, pressure, speed, and vibration frequency; the potential fault of the industrial system to be tested refers to the potential fault of the engine. During the engine's operation, sensors distributed in various parts of the engine play a crucial role. The sensors collect data from multiple dimensions such as engine temperature, pressure, speed, and vibration frequency. For example, temperature sensors collect cylinder block temperature and coolant temperature; pressure sensors collect fuel pressure and oil pressure; speed sensors collect engine speed; and vibration frequency sensors collect engine vibration. This data forms a multivariate time series of the engine's operating state. The collected time series data is input into S102-S104 of this application, and the data is filtered to identify the reconstruction characteristics between engine temperature, pressure, and speed. Based on the original time series and the set of reconstruction characteristics, the reconstruction error is determined; based on the reconstruction process, a deep feature score is constructed; based on the distribution relationship of reconstruction errors corresponding to multiple variables, a multivariate residual analysis index is determined; based on the reconstruction error, deep feature score, and multivariate residual analysis index, a comprehensive anomaly score is determined; based on the comprehensive anomaly score, time series anomaly judgment is completed, and the presence of anomalies in the engine is output. If any abnormalities are found, it means that the engine may have a potential fault, such as abnormal vibration or component wear. The company can replace the worn parts in advance and adjust the engine to prevent the fault from worsening, reduce equipment downtime, reduce maintenance costs, and improve the company's production efficiency.

[0021] Further, in step S101: Sensors deployed in the industrial system under test are used to collect multivariate time series data generated during the operation of the industrial system under test; the collected data is preprocessed to obtain a set of original time series data for anomaly detection of the industrial system under test; the preprocessing includes: First, a unified data preprocessing operation is performed to reduce the impact of the non-stationary dynamic characteristics and numerical scale differences of time series data on the subsequent modeling process.

[0022] Define multivariate time series ,in Indicates the sequence length. Indicates the number of variables. Represents timestamp Multivariate observations at the location.

[0023] To characterize the dynamic characteristics of the system's operating mechanism at local time scales and reduce the interference of non-stationary factors on the local statistical structure, a sliding window mechanism is used to divide the original time series into segments of length [missing information]. Continuous subsequences are used to enhance the model's ability to characterize local temporal dynamics and ensure the consistency of the input sequence structure during subsequent feature modeling. ,

[0024] in, Indicates the first Subsequences Indicates the first to part.

[0025] Subsequently, reversible instance normalization is performed on each subsequence to eliminate numerical scale differences between different variables, reduce the interference of non-essential numerical shifts on mechanism modeling, alleviate distribution drift problems, and improve the modeling stability in multivariate time series scenarios.

[0026] in, This represents the reversible instance normalization operation. Indicates the first Subsequences Indicates the first The result of performing reversible instance normalization on each subsequence.

[0027] Through the above preprocessing operations, multivariate time series from different fields are unified and standardized in terms of time scale, numerical distribution and sequence structure, providing a reliable data foundation for subsequent feature modeling and anomaly detection.

[0028] Further, step S102: extracting time series features from each time series in the original time series set to obtain a time series feature representation, including: A first Transformer encoder is used to extract temporal features from each time series in the original time series set. The first Transformer encoder includes: a first-layer normalization module, a multi-head attention mechanism layer, a second-layer normalization module, and a feedforward neural network connected in sequence.

[0029] After data preprocessing, the normalized subsequences are mapped to a unified feature representation space through linear projection, enabling time series data from different time segments and different variables to be jointly modeled in the same feature space. ,

[0030] in, For linear embedding matrices, This represents the bias vector. Indicates the hidden feature dimension. No. The initial hidden representation obtained by linear mapping of subsequences.

[0031] Based on this, a Transformer encoder is used to jointly model the cross-time dependency and cross-variable action structure in order to characterize the collaborative characteristics of the normal operation mechanism of the system in the time and variable dimensions.

[0032] Specifically, the feature distribution is first stabilized through layer normalization. Then, a multi-head attention mechanism is used to simultaneously model the correlation between the time and variable dimensions within a unified representation space. This enables the model to adaptively capture anomalous changes in local dynamic responses, deviations in cross-variable cooperative relationships, and disruptions of long-range dependency structures under a global attention mechanism, thus maintaining sensitivity to potential mechanism perturbations. The original input and the multi-head attention output are fed into a feedforward neural network after residual connections and layer normalization to enhance the model's nonlinear expressive power and improve its ability to model complex dynamic patterns. The output of the feedforward neural network (FFN) is also stabilized through residual connections, ultimately yielding a stable and structure-aware numerical dynamic representation. This is used to characterize the operational behavior pattern under normal conditions. The entire process is formalized as follows:

[0033] ,

[0034] in, Presentation layer normalization operation, This represents a multi-head attention mechanism. Ultimately, the encoder outputs a temporal feature representation. It not only contains local numerical dynamic information, but also implicitly encodes the interaction relationship between variables and its temporal evolution characteristics, providing a foundation for subsequent mechanism constraints and anomaly detection.

[0035] It should be understood that the Transformer encoder is used to extract features from multivariate time series, and jointly model local dynamic changes, long-range dependency structures and cross-variable collaborative patterns to obtain time series feature representations that have structure awareness and stably represent the dynamic characteristics of time series.

[0036] It should be understood that time series features are extracted from each time series in the time series set, and the dynamic changes in the time dimension and the dependencies in the variable dimension are jointly characterized to represent the interaction patterns between variables during the system operation, thus obtaining a time series feature representation.

[0037] Further, in step S103: based on the statistical attribute information of the corresponding variables of each time series in the original time series set, a semantic description is constructed, the semantic description including: mean, standard deviation, series value range, overall trend strength, and relative volatility.

[0038] Among them, the relative fluctuation degree To represent the dispersion of a sequence relative to the mean, the standard deviation of the subsequences is calculated. with the mean The ratio, used to distinguish between stable and abnormal fluctuations, is defined as follows:

[0039] The overall trend strength This is used to quantify the overall direction and magnitude of change in a time series within a window. It is obtained by averaging the differences between adjacent time points of a subsequence, thus reflecting the long-term evolution trend of the series. It is defined as follows:

[0040] in, Indicates the length of the subsequence. Indicates time The observation at point represents the time... The observed values ​​at the specified location. A structured semantic description text at the variable level is constructed based on statistical attribute information to explicitly express the current statistical state of the time series.

[0041] Further, in S103: semantically encoding the semantic description to obtain the initial statistical semantic feature representation is performed by encoding through a pre-trained large language model, wherein the pre-trained large language model includes: a masked multi-head attention mechanism layer, a first normalization module, a feedforward neural network layer, and a second normalization module connected in sequence. Specifically, the masked multi-head attention mechanism layer introduces positional and contextual dependencies into the semantic encoding process. By applying a masking mechanism to the input semantic description sequence, it restricts the current semantic unit to focus only on the semantic information preceding it, thereby modeling the ordered dependencies and contextual relationships between statistical concepts in the statistical semantic description. This layer can simultaneously characterize the correlations between different statistical semantic components, such as trend changes, fluctuation characteristics, and statistical distributions, in different attention subspaces, enabling the generated semantic representation to take into account both local statistical features and overall statistical state information.

[0042] The first-layer normalization module is used to normalize the output of the mask multi-head attention mechanism to stabilize the feature distribution, alleviate gradient fluctuation problems, and improve the numerical stability of the semantic encoding process under different time windows and different variable conditions.

[0043] Feedforward neural network layers are used to perform nonlinear transformations and feature mappings on attention-modeled semantic features to enhance the ability of statistical semantic representation to express higher-order statistical patterns and abstract concepts.

[0044] The second-layer normalization module is used to normalize the output of the feedforward neural network to further balance the numerical scales between different statistical semantic dimensions, ensuring the stability and consistency of the semantic representation in the subsequent semantic association modeling and semantic guidance fusion process.

[0045] In addition, residual connection structures are also included between the above functional layers, including the fusion of the initial input and the output of the masked multi-head attention mechanism layer through residual connections; and the fusion of the output of the first layer normalization module and the output of the feedforward neural network layer through residual connections.

[0046] By using residual connection structures, the basic information in the original statistical semantic description can be effectively preserved, while avoiding information loss during deep semantic modeling, thereby improving the robustness of semantic encoding.

[0047] Furthermore, the step of constructing a semantic description based on the statistical attribute information of the corresponding variables of each time series in the original time series set, and semantically encoding the semantic description to obtain an initial statistical semantic feature representation, includes: S103-1: Based on the sliding window mechanism, the original multivariate time series is segmented to obtain the multivariate time series subsequences located within the current time window. ,in Indicates the sequence length. Indicates the number of variables.

[0048] For each variable, key statistical attributes are extracted within the current time window, including mean, standard deviation, range, overall trend strength, and relative volatility, to characterize the variable's behavior within this time period from multiple dimensions such as central tendency, dispersion, and direction of evolution. These statistics describe the overall behavioral characteristics of the time series within the current time period from different aspects such as central tendency, dispersion, and direction of evolution.

[0049] S103-2: Based on the extracted statistical attributes, a structured semantic description text at the variable level is further constructed to explicitly express the statistical operating status of the time series within the current window and its potential mechanistic characteristics. The semantic description follows a unified template format, organizing the original time series values ​​and statistical summary information into text with a natural language structure to ensure the consistency and comparability of semantic representations for different variables and different time periods.

[0050] For any variable, its corresponding semantic description text shall include at least: continuous observations of the variable within the current time window, as well as the mean, standard deviation, range, overall trend strength, and relative volatility of the observations; the mean of the observations, used to characterize the central tendency of the variable; the standard deviation of the observations, used to characterize the volatility of the variable; the range of the observations, used to describe the numerical distribution interval of the variable; the overall trend strength of the observations, used to reflect the direction and magnitude of the variable's change over time; and the relative volatility of the observations, used to measure the degree of dispersion of the variable's volatility relative to its mean.

[0051] The time series values ​​in the text correspond to the continuous values ​​within the window. The observation results at each time step are summarized in the statistical summary section, which outlines the overall dynamic characteristics within that time window.

[0052] Among them, the relative fluctuation degree To represent the dispersion of a sequence relative to the mean, the standard deviation of the subsequences is calculated. with the mean The ratio, used to distinguish between stable and abnormal fluctuations, is defined as follows:

[0053] Among them, trend strength Used to quantify the overall direction and magnitude of change in a time series within a window, it is obtained by averaging the differences between adjacent time points of the subsequence, thus reflecting the long-term evolution trend of the series. It is defined as follows:

[0054] in, Indicates the length of the subsequence. Indicates time The observation at point represents the time... The observed value at that location.

[0055] S103-3: Subsequently, the constructed semantic description text is input into the pre-trained large language model. Utilizing the statistical concept abstraction and semantic alignment capabilities learned by the pre-trained large language model from large-scale corpora, the corresponding statistical semantic embedding representation is generated. ,in This represents the semantic embedding dimension.

[0056] S103-4: Next, the semantic embedding representation is projected onto the unified feature space through a linear mapping: ,

[0057] in, This is the projection matrix.

[0058] The pre-trained large language model uses training data including general natural language text corpora and professional text corpora containing statistical analysis, data descriptions, and engineering technical documents. This data is used to learn semantic representation capabilities for statistical concepts, trend changes, and fluctuation characteristics. Based on the pre-trained large language model, the structured semantic description text is semantically encoded to obtain initial statistical semantic feature representations.

[0059] The initial statistical semantic features include statistical concepts such as trends or fluctuations. These are used to characterize the statistical consistency of variable behavior under normal operating conditions.

[0060] Based on the Transformer encoder, semantic association modeling is performed on the initial statistical semantic feature representation. The correlation, consistency and potential structural constraints between the statistical semantics of different variables are learned, resulting in a statistical semantic representation with semantic consistency and correlation.

[0061] Further, step S103: Modeling semantic relationships on the initial statistical semantic feature representation to obtain a statistical semantic representation, implemented using a semantic encoder, includes: Semantic embeddings are represented as sequences of semantic tokens with variables as the basic unit and are input into a semantic Transformer encoder for modeling.

[0062] Unlike the temporal feature extraction path, which uses time steps as the modeling object, each token in the semantic extraction path represents a statistical semantic summary of a single variable within the current sliding window. Essentially, it corresponds to a higher-order conceptual expression of the variable's operating mechanism within that time period.

[0063] Multi-head self-attention mechanisms can adaptively learn statistical semantic alignment relationships between variables in the semantic space, thereby capturing common change patterns, collaborative shifts, and implicit structural dependencies across variables. Formally, this can be represented as:

[0064] in, Indicates the first The output of the layer semantic Transformer encoder.

[0065] Although the semantic Transformer encoder uses the same Transformer architecture as the temporal feature path in terms of network structure, its attention mechanism focuses on modeling the structural dependencies between variable-level statistical semantics, rather than the dynamic dependencies in the time dimension.

[0066] While pre-trained large language models can provide rich semantic representations, directly using their output may result in inconsistencies in context or semantic noise. Therefore, this invention employs a Transformer encoder to perform structured modeling of semantic embeddings, thereby enhancing the consistency, relevance, and potential structural constraints of statistical semantics across variable dimensions.

[0067] Further, in step S104: based on the statistical semantic representation, the feature dimensions related to the interaction relationship of variables in the time series feature representation are constrained and strengthened to obtain a fused feature set, specifically including: constraining and strengthening through a mechanism constraint strategy guided by statistical semantics.

[0068] Time series feature representation With semantic feature representation Interaction is achieved through a learnable cross-attention mechanism, where temporal features guide the semantic retrieval process, resulting in a semantically enhanced temporal representation constrained by statistical semantic priors. The computation process is defined as follows:

[0069]

[0070] in, Represents the query vector. Represents the key vector. Represents the Value vector. This represents the feature dimension of the Query and Key vectors in the attention subspace. Represents the set of fused features; To avoid excessive perturbation of the original numerical representation by semantic information, the injected semantic representation is fused with temporal features through residual connections and layer normalization. While maintaining the stability of the numerical dynamic structure, statistical constraints consistent with the current mechanism state are introduced to obtain a stable and mechanism-consistent semantically enhanced temporal representation.

[0071] in, The representation layer normalization operation is used to balance the scale difference between statistical semantic constraints and numerical dynamic features, further improving the modeling stability in complex dynamic and noisy scenarios.

[0072] In anomaly detection tasks, anomalies typically manifest only within a local timeframe or a specific subset of variables, and their corresponding statistical semantics exhibit significant contextual dependence and state relevance. This characteristic dictates that the introduction of statistical semantic knowledge must be subject to explicit mechanism constraints; that is, semantic information should be selectively activated based on the current numerical dynamic state, rather than being uniformly injected as a global semantic feature. Simultaneously, semantic knowledge should be primarily driven by numerical temporal features, with its representation learning process constrained only by higher-order priors to avoid negatively interfering with the original numerical dynamics. Based on this, this invention proposes a statistical semantic-guided mechanism constraint module, employing a directional cross-attention mechanism using numerical temporal features as query vectors and statistical semantic embeddings as key and value vectors. This enables the model to selectively retrieve and aggregate statistical concept representations most consistent with the current dynamic pattern from the statistical semantic space.

[0073] Based on the mechanism constraint strategy guided by statistical semantics, and through a learnable directional cross-attention mechanism, the system uses time series features as query vectors and statistical semantics as key vectors and value vectors to selectively retrieve and aggregate statistical concept representations that are most consistent with the current dynamic pattern from the statistical semantic space. This achieves selective and directional fusion of statistical semantic knowledge into numerical time series representation, resulting in a fused feature set containing both time series dynamic information and statistical semantic information.

[0074] The fusion feature set includes: temporal dynamic information and statistical semantic information.

[0075] Further, step S104: reconstructing the fused feature set to obtain a reconstructed feature set, specifically includes: Based on the Transformer decoder, the fused feature set is reconstructed, and the temporal representation of the fused semantics is enhanced. Reconstruction is performed to obtain a set of reconstructed features. : .

[0076] Further, S105: Based on the original time series and the reconstructed feature set, determine the reconstruction error, specifically including: based on the difference between the original time series data and the reconstructed feature set, obtain the reconstruction error that reflects the consistency of time series reconstruction; Given the first The sample at the th Time series on 1 variable and its reconstruction results Reconstruction error score Defined as:

[0077] Relying solely on reconstruction errors often fails to reveal the underlying mechanistic changes in potential high-dimensional representation spaces.

[0078] Reconstruction error reflects the model's ability to consistently model the normal time dynamics of the system. Given a multivariate time series as input and its corresponding model reconstruction result, the reconstruction error score for each variable is obtained by calculating the mean squared deviation of the two in the time dimension. Under normal operating conditions, the model can stably reconstruct the time series dynamically. When the system's operating mechanism is disturbed, even if the local numerical shift is limited, the overall reconstruction consistency will significantly decrease. Reconstruction error mainly reflects the disruption of consistency of the time dynamics caused by explicit numerical shifts, local dynamic disturbances, and trend changes, and is highly sensitive to sudden anomalies and strong dynamic disturbances.

[0079] Further, S105: Based on the reconstruction process, a deep feature score is constructed, specifically including: Based on the latent feature representations obtained during the feature reconstruction process, a deep feature score reflecting the degree of deviation from the latent feature distribution is calculated; definition Indicates the first In the nth sample The decoded feature representation corresponding to each variable, then the deep feature score Defined as:

[0080] in, , For learnable parameters, , This represents the bias vector. Indicates a modified linear unit. This is the Sigmoid function.

[0081] To facilitate unified modeling with other anomaly scoring systems, it will be further converted into... form:

[0082] By modeling the semantically constrained latent feature representation through nonlinear mapping, the deviation from the normal operation mechanism is evaluated from the perspectives of latent pattern stability and representation consistency. Unlike reconstruction error, this score does not rely on explicit numerical bias, but rather identifies nonlinear pattern shifts and implicit mechanism changes from the feature representation space. It still has strong discriminative ability even when numerical changes are not obvious but the operation mode has changed.

[0083] Further, S105: Based on the reconstruction error distribution relationship corresponding to multiple variables, determine the multivariate residual analysis index, specifically including: definition Indicates the first The reconstruction error vector of each sample is then defined as the residual analysis score. for:

[0084] in, , For learnable parameters, , This represents the bias vector. This indicates a modified linear unit.

[0085] Multivariate time series data in industrial systems are typically constrained by long-term physical laws or system logic, and stable cooperative relationships usually exist between variables. When anomalies occur, even if the numerical changes of individual variables are not significant, this cross-variable cooperative mechanism and consistency structure often break down first. Therefore, this invention introduces multivariate residual analysis based on the reconstruction error distribution to characterize the degree to which the cooperative mechanism between variables deviates from its normal state. This scoring can capture structural anomalies such as the failure of cooperative relationships between variables and the destruction of cooperative mechanisms, effectively compensating for the shortcomings of univariate scoring.

[0086] Based on the reconstruction error distribution relationship of multiple variables, the structural consistency among variables is analyzed, and the results of multivariate residual analysis reflecting cross-variable structural changes are obtained.

[0087] Based on the reconstruction error distribution relationship of multiple variables, multivariate residual analysis is performed to obtain structural anomaly indicators that characterize changes in the interaction mechanism between variables.

[0088] Further, S105: Based on reconstruction error, deep feature score, and multivariate residual analysis index, a comprehensive anomaly score is determined, specifically including: The reconstruction error, depth feature score, and multivariate residual analysis index are weighted and fused to obtain a comprehensive anomaly score.

[0089] For reconstruction error Deep feature scoring and multivariate residual analysis A weighted fusion is performed to obtain a comprehensive anomaly score, and time series anomaly identification is completed based on the comprehensive anomaly score, outputting potential anomalies:

[0090] in, , , This represents the relative contribution weight of each perspective's score to the mechanism's disruption under different abnormal scenarios. .

[0091] Further, S105: Based on the comprehensive anomaly score, complete the time series anomaly identification and output the potential fault of the target system, specifically including: comparing the comprehensive anomaly score with a set threshold, and if it exceeds the set threshold, then the target system is identified as having a potential fault.

[0092] In this invention, "industry" refers to the industry that provides energy and raw materials for manufacturing by continuously and complexly reacting and changing target resources. It typically includes industries such as food, beverage, pharmaceuticals, steel, non-ferrous metals, cement, papermaking, and chemicals. In industrial application scenarios, abnormal operating conditions are prone to occur during the production process, such as abnormal vibration or temperature. If technicians cannot detect these abnormalities in time, it can easily lead to equipment failure or even serious accidents.

[0093] In industrial applications, multivariate time series data typically originates from multi-sensor monitoring of system operating status. For example, in one specific embodiment, the industrial system under test can be an industrial device (engine) or an industrial process system. During its operation, multiple sensors collect monitoring data across multiple dimensions, such as vibration signals, rotational speed parameters, pressure parameters, and temperature parameters. This monitoring data dynamically changes over time, reflecting the operating status of the industrial system under test. In this embodiment, the operating parameters of different components or sub-modules within the industrial system under test are coupled. For instance, changes in temperature parameters may cause linked changes in pressure and vibration parameters, thus reflecting changes in the internal operating mechanism of the industrial system under test. Using the anomaly detection method of this embodiment, time series data from multiple monitoring dimensions can be jointly analyzed to promptly identify potential abnormal states or fault risks during system operation, such as abnormal vibration, performance degradation, or component wear in the industrial system under test. This supports preventative maintenance of the system, reduces equipment maintenance costs, and minimizes unplanned downtime.

[0094] This invention employs a pre-trained large language model to semantically encode the statistical features of multivariate time series, constructing a high-level statistical semantic representation that incorporates information on trend changes, fluctuation characteristics, and statistical distribution. This representation serves as a priori constraint on the normal operation mechanism of the system. Through a dual-path modeling approach that coordinates time-series feature paths and semantic knowledge paths, it achieves joint modeling of local dynamic changes, long-range time-series dependencies, and intervariate structural relationships in time series. Based on a statistical semantic-guided mechanism constraint strategy, a learnable directed attention mechanism selectively retrieves statistical concepts most relevant to the current dynamic pattern from the statistical semantic prior space. This constrains and strengthens the response of the time series representation to changes in key operational mechanisms, thereby suppressing interference from irrelevant semantics or noisy statistical descriptions and constructing a stable and mechanism-consistent time series representation. A multi-perspective anomaly scoring mechanism comprehensively discriminates anomalous behavior from three complementary perspectives: time series reconstruction consistency, latent feature stability, and intervariate interaction mechanism residuals. Ultimately, this improves the accuracy and stability of time series anomaly detection.

[0095] The overall concept proposed in this invention is as follows: First, a two-layer Transformer encoder is used to extract features from multivariate time series, and to jointly model local dynamic changes, long-range dependency structures and cross-variable collaborative patterns, so as to obtain time series feature representations with structure awareness and stable representation of time series dynamics, thereby enhancing the model's overall ability to characterize complex time series dynamics and cross-variable relationships.

[0096] Concurrently, for each variable corresponding to each time series, key statistical attributes such as mean, standard deviation, range, overall trend strength, and relative volatility are extracted. This leads to the construction of a variable-level structured semantic description text, explicitly expressing the statistical state of the time series and abstractly characterizing its overall operational state from a statistical perspective. A pre-trained large language model is then used to semantically encode and represent the semantic description text, obtaining initial statistical semantic feature representations containing statistical concepts such as trend and volatility. This allows the model to obtain high-level statistical semantic priors before in-depth modeling of time series features. Based on a Transformer encoder, semantic relationship modeling is performed on the initial statistical semantic feature representations, learning the correlation, consistency, and potential structural constraints between the statistical semantics of different variables. This yields statistical semantic representations with semantic consistency and correlation, characterizing the intrinsic relational structure between multivariate statistical states.

[0097] Subsequently, based on the mechanism constraint strategy guided by statistical semantics, a learnable directional cross-attention mechanism is used. Time series features are represented as query vectors, and statistical semantics are represented as key vectors and value vectors. The statistical concept representations that are most consistent with the current dynamic pattern are selectively retrieved and aggregated from the statistical semantic space. This achieves selective and directional fusion of statistical semantic knowledge into numerical time series representation, thereby avoiding interference from irrelevant or redundant semantic information on time series dynamic modeling, and obtaining a fused feature set containing time series dynamic information and statistical semantic information.

[0098] Finally, feature reconstruction is performed on the fused feature set. Based on the differences between the original time series data and the reconstructed feature set, a reconstruction error reflecting the consistency of time series reconstruction is obtained. Based on the latent feature representations obtained during feature reconstruction, a deep feature score reflecting the degree of deviation in the latent feature distribution is calculated. Based on the reconstruction error distribution relationships among multiple variables, the structural consistency among variables is analyzed, resulting in a multivariate residual analysis that reflects cross-variable structural changes. This multi-perspective approach comprehensively characterizes different manifestations of anomalous behavior. A weighted fusion of the reconstruction error, deep feature score, and multivariate residual analysis results yields a comprehensive anomaly score and outputs potential anomalies, improving the accuracy and stability of anomaly detection.

[0099] This invention collects and preprocesses multivariate time series data from different scenarios or fields to obtain a standardized time series set. It then extracts temporal features from the time series set to obtain a time series feature representation with structure awareness and stable representation of temporal dynamics. Based on the statistical attribute information of the corresponding variables in the time series, it constructs a statistical semantic description and semantically encodes it to obtain an initial statistical semantic feature representation containing statistical concepts such as trends and fluctuations. Semantic relationship modeling is performed on the initial statistical semantic feature representation to obtain a statistical semantic representation with semantic consistency and correlation. Through a mechanism constraint strategy guided by statistical semantics, the feature dimensions related to variable interaction in the time series feature representation are constrained and strengthened based on the statistical semantic representation to obtain a fused feature set containing temporal dynamic information and statistical semantic information. The fused feature set is reconstructed to obtain a reconstructed feature set. Based on the differences between the original time series and the reconstructed feature set, a multi-perspective anomaly score is constructed from three complementary perspectives: reconstruction consistency, potential feature anomalies, and residuals of cross-variable action mechanisms. This score is then weighted and fused to obtain a comprehensive anomaly score, completing the time series anomaly identification and outputting potential anomaly results.

[0100] Example 2 This embodiment provides a multi-view time series anomaly detection system; A multi-view time series anomaly detection system includes: The data acquisition and preprocessing module is configured to: acquire multivariate time series data generated during the operation of the industrial system under test using sensors deployed in the industrial system under test; preprocess the acquired data to obtain a set of original time series data for anomaly detection of the industrial system under test; wherein, the multivariate time series includes time series data corresponding to multiple monitoring variables reflecting the system operating status, and the monitoring variables include one or more of process state parameters, system operating performance parameters, or environmental state parameters; The feature extraction module is configured to extract time series features from each time series in the original time series set to obtain a time series feature representation. The semantic encoding module is configured to: construct a semantic description based on the statistical attribute information of the corresponding variables of each time series in the original time series set, and perform semantic encoding on the semantic description to obtain an initial statistical semantic feature representation; and model the semantic association relationship of the initial statistical semantic feature representation to obtain a statistical semantic representation. The constraint and reinforcement module is configured to: constrain and reinforce the feature dimensions related to the interaction between variables in the time series feature representation based on the statistical semantic representation to obtain a fused feature set; and reconstruct the fused feature set to obtain a reconstructed feature set. The output module is configured to: determine the reconstruction error based on the original time series and the reconstructed feature set; construct a deep feature score based on the reconstruction process; determine the multivariate residual analysis index based on the reconstruction error distribution relationship of multiple variables; determine the comprehensive anomaly score based on the reconstruction error, the deep feature score, and the multivariate residual analysis index; and complete the time series anomaly discrimination based on the comprehensive anomaly score, and output the potential faults of the industrial system to be detected.

[0101] It should be noted that the aforementioned acquisition and preprocessing module, feature extraction module, semantic encoding module, constraint and reinforcement module, and output module correspond to steps S101 to S105 in Embodiment 1. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in Embodiment 1. It should also be noted that these modules, as part of the system, can be executed in a computer system, such as a set of computer-executable instructions.

[0102] The descriptions of each embodiment in the above embodiments have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0103] The proposed system can be implemented in other ways. For example, the system embodiments described above are merely illustrative, and the division of modules described above is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.

[0104] Example 3 This embodiment also provides an electronic device, including: one or more processors, one or more memories, and one or more computer programs; wherein, the processor is connected to the memory, and the one or more computer programs are stored in the memory. When the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform the method described in Embodiment 1.

[0105] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0106] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0107] In the implementation process, each step of the above method can be completed by the integrated logic circuits in the processor hardware or by software instructions.

[0108] The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0109] Those skilled in the art will recognize that the units and algorithm steps described in connection with the various examples of this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0110] Example 4 This embodiment also provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the method described in Embodiment 1.

[0111] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multi-view time series anomaly detection method, characterized by: include: Sensors deployed in the industrial system under test are used to collect multivariate time series data generated during the operation of the industrial system under test. The collected data is preprocessed to obtain a set of original time series data for anomaly detection of the industrial system under test. Time series features are extracted from each time series in the original time series set to obtain a time series feature representation; Based on the statistical attribute information of the corresponding variables of each time series in the original time series set, a semantic description is constructed, and the semantic description is semantically encoded to obtain the initial statistical semantic feature representation. Semantic association modeling is performed on the initial statistical semantic feature representation to obtain the statistical semantic representation; Based on the statistical semantic representation, the feature dimensions related to variable interactions in the time series feature representation are constrained and strengthened to obtain a fused feature set; The feature sets are merged and reconstructed to obtain the reconstructed feature set; Based on the original time series and the reconstructed feature set, the reconstruction error is determined; Based on the reconstruction process, a deep feature score is constructed; Based on the reconstruction error distribution relationship corresponding to multiple variables, the multivariate residual analysis index is determined; based on the reconstruction error, depth feature score and multivariate residual analysis index, the comprehensive anomaly score is determined; based on the comprehensive anomaly score, the time series anomaly discrimination is completed, and the potential faults of the industrial system to be detected are output.

2. The multi-view time series anomaly detection method as described in claim 1, characterized in that, Temporal features are extracted from each time series in the original time series set to obtain a time series feature representation, including: A first Transformer encoder is used to extract temporal features from each time series in the original time series set. The first Transformer encoder includes: a first-layer normalization module, a multi-head attention mechanism layer, a second-layer normalization module, and a feedforward neural network connected in sequence. After data preprocessing, the normalized subsequences are mapped to a unified feature representation space through linear projection, enabling time series data from different time segments and different variables to be jointly modeled in the same feature space. ， in, For linear embedding matrices, This represents the bias vector. Indicates the hidden feature dimension. No. The initial hidden representation obtained by linear mapping of subsequences.

3. The multi-view time series anomaly detection method as described in claim 1, characterized in that, Based on the statistical attribute information of the corresponding variables of each time series in the original time series set, a semantic description is constructed. The semantic description includes: mean, standard deviation, range of series values, overall trend strength, and relative volatility.

4. The multi-view time series anomaly detection method as described in claim 1, characterized in that, Semantic encoding of the semantic description yields an initial statistical semantic feature representation. Encoding is performed using a pre-trained large language model, which includes: a masked multi-head attention mechanism layer, a first-layer normalization module, a feedforward neural network layer, and a second-layer normalization module connected in sequence. Semantic association modeling is performed on the initial statistical semantic feature representation to obtain a statistical semantic representation, which is implemented using a semantic encoder. This includes: the semantic embedding is represented as a sequence of semantic tokens with variables as basic units, and input into the semantic Transformer encoder for modeling.

5. The multi-view time series anomaly detection method as described in claim 1, characterized in that, Based on the statistical semantic representation, the feature dimensions related to the interaction between variables in the time series feature representation are constrained and strengthened to obtain a fused feature set, specifically including: constraining and strengthening through a mechanism constraint strategy guided by statistical semantics; Time series feature representation With semantic feature representation Interaction is achieved through a learnable cross-attention mechanism, where temporal features guide the semantic retrieval process, resulting in a semantically enhanced temporal representation constrained by statistical semantic priors. The computation process is defined as follows: in, Represents the query vector. Represents the key vector. Represents the Value vector. This represents the feature dimension of the Query and Key vectors in the attention subspace. Represents the set of fused features; By introducing statistical constraints consistent with the current mechanism state, a stable and mechanism-consistent semantically enhanced temporal representation is obtained: in, The representation layer normalization operation is used to balance the scale difference between statistical semantic constraints and numerical dynamic features.

6. The multi-view time series anomaly detection method as described in claim 1, characterized in that, The fused feature set is reconstructed to obtain the reconstructed feature set, which specifically includes: Based on the Transformer decoder, the fused feature set is reconstructed, and the temporal representation of the fused semantics is enhanced. Reconstruction is performed to obtain a set of reconstructed features. : 。 7. The multi-view time series anomaly detection method as described in claim 1, characterized in that, Based on the original time series and the reconstructed feature set, the reconstruction error is determined, specifically including: obtaining the reconstruction error that reflects the consistency of time series reconstruction based on the difference between the original time series data and the reconstructed feature set; Given the first The sample at the th Time series on 1 variable and its reconstruction results Reconstruction error score Defined as: Relying solely on reconstruction errors often fails to reveal the underlying mechanisms of change in potential high-dimensional representation spaces; Based on the reconstruction process, a deep feature score is constructed, specifically including: Based on the latent feature representations obtained during the feature reconstruction process, a deep feature score reflecting the degree of deviation from the latent feature distribution is calculated; definition Indicates the first In the nth sample The decoded feature representation corresponding to each variable, then the deep feature score Defined as: in, , For learnable parameters, , This represents the bias vector. Indicates a modified linear unit. For the Sigmoid function; Based on the reconstruction error distribution relationship corresponding to multiple variables, multivariate residual analysis indices are determined, specifically including: definition Indicates the first The reconstruction error vector of each sample is then defined as the residual analysis score. for: in, , For learnable parameters, , This represents the bias vector. Indicates a modified linear unit; Based on reconstruction error, deep feature scoring, and multivariate residual analysis indicators, a comprehensive anomaly score is determined, specifically including: A comprehensive anomaly score is obtained by weighted fusion of reconstruction error, depth feature score and multivariate residual analysis index. For reconstruction error Deep feature scoring and multivariate residual analysis A weighted fusion is performed to obtain a comprehensive anomaly score, and time series anomaly identification is completed based on the comprehensive anomaly score, outputting potential anomalies: in, , , This represents the relative contribution weight of each perspective's score to the mechanism's disruption under different abnormal scenarios. .

8. A multi-view time series anomaly detection system, characterized in that, include: The data acquisition and preprocessing module is configured to: acquire multivariate time series generated during the operation of the industrial system under test using sensors deployed in the industrial system under test; preprocess the acquired data to obtain a set of original time series for anomaly detection of the industrial system under test. The feature extraction module is configured to extract time series features from each time series in the original time series set to obtain a time series feature representation. The semantic encoding module is configured to: construct a semantic description based on the statistical attribute information of the corresponding variables of each time series in the original time series set, and perform semantic encoding on the semantic description to obtain an initial statistical semantic feature representation; Semantic association modeling is performed on the initial statistical semantic feature representation to obtain the statistical semantic representation; The constraint and reinforcement module is configured to: constrain and reinforce the feature dimensions related to the interaction between variables in the time series feature representation based on the statistical semantic representation to obtain a fused feature set; and reconstruct the fused feature set to obtain a reconstructed feature set. The output module is configured to: determine the reconstruction error based on the original time series and the reconstructed feature set; and construct a deep feature score based on the reconstruction process. Based on the reconstruction error distribution relationship corresponding to multiple variables, the multivariate residual analysis index is determined; based on the reconstruction error, depth feature score and multivariate residual analysis index, the comprehensive anomaly score is determined; based on the comprehensive anomaly score, the time series anomaly discrimination is completed, and the potential faults of the industrial system to be detected are output.

9. An electronic device, characterized in that it comprises: Memory is used to store computer-readable instructions in a non-transitory manner. as well as Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the method described in any one of claims 1-7.

10. A storage medium, characterized in that, Non-transitory storage of computer-readable instructions, wherein when the non-transitory computer-readable instructions are executed by a computer, the method of any one of claims 1-7 is performed.

Images