Small sample cold source system anomaly detection method and device based on graph neural network

Abstract

The invention provides a small sample cold source system anomaly detection method and device based on a graph neural network, and relates to the technical field of anomaly detection, and the method comprises the steps: carrying out the data processing of multi-source monitoring data, obtaining time series data, building a graph structure according to the physical coupling relation between various monitoring indexes in the time series data, and obtaining a graph structure; performing feature extraction processing on the graph structure through a graph neural network to obtain node embedding features; performing time sequence modeling processing on the node embedding characteristics through a long short-term memory network to obtain a prediction vector, and performing self-supervised disturbance training on the graph structure to generate a simulated positive sample and a simulated negative sample so as to obtain a coupling sensitive vector based on the prediction vector, the positive sample and the negative sample; and calculating an anomaly sensitivity set based on the coupling sensitivity vector, and determining a multi-scale coupling anomaly score based on the anomaly sensitivity set, so as to determine a target anomaly detection result according to the multi-scale coupling anomaly score. According to the invention, the anomaly detection sensitivity of the cold source system can be obviously improved.

Description

Technical Field

[0001] This invention relates to the technical field of anomaly detection, and in particular to an anomaly detection method and apparatus for a small-sample cold source system based on graph neural networks. Background Technology

[0002] The nuclear power plant's cooling source system is a crucial support for the safe operation of nuclear power units. Its operational status monitoring and anomaly early warning mainly rely on parameter data collected by the operation monitoring system. Currently, related technologies propose commonly used anomaly detection methods, including manual rules and static threshold judgments, supervised machine learning models, and traditional unsupervised detection algorithms. However, manual rules and static threshold judgments rely too heavily on experience, easily leading to false alarms or missed alarms. Supervised machine learning models require a large number of real fault samples and have high annotation costs. Traditional unsupervised detection algorithms lack the ability to model multivariate dynamic coupling relationships and time series trends, and their generalization ability is limited, making it difficult to capture weak trend anomalies. In addition, cooling source systems often exhibit weak trend anomalies before anomalies occur, and the anomaly detection sensitivity of the above-mentioned existing technical solutions is low, and they generally lack the ability to identify pre-fault symptoms. Therefore, it is difficult to achieve effective early warning. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a method and apparatus for anomaly detection in a small sample cold source system based on graph neural networks, which can significantly improve the sensitivity of anomaly detection in the cold source system.

[0004] In a first aspect, embodiments of the present invention provide a method for detecting anomalies in a small-sample cold source system based on a graph neural network. The method includes: processing multi-source monitoring data of the cold source system to obtain standardized time-series data, constructing a graph structure based on the physical coupling relationship between various monitoring indicators in the time-series data, and extracting node embedding features from the graph structure using a graph neural network; performing time-series modeling on the node embedding features using a long short-term memory network to obtain a prediction vector, and generating simulated positive and negative samples by performing self-supervised perturbation training on the graph structure, and optimizing the latent feature space based on the prediction vector, positive samples, and negative samples to obtain an enhanced coupling sensitivity vector; calculating an anomaly sensitivity set based on the coupling sensitivity vector, and performing weighted fusion processing on each anomaly sensitivity in the anomaly sensitivity set to obtain a multi-scale coupling anomaly score, and determining the target anomaly detection result based on the multi-scale coupling anomaly score, wherein the anomaly sensitivity set includes: local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity.

[0005] In one implementation, the step of processing multi-source monitoring data of a cold source system to obtain standardized time-series data includes: performing linear interpolation repair on short-term missing data in the multi-source monitoring data and removing time-series windows corresponding to long-term missing data to obtain a complete and continuous monitoring sequence; removing acquisition error points in the monitoring sequence to obtain cleaned monitoring data; and normalizing the cleaned monitoring data according to the physical upper and lower limits of each monitoring indicator within a preset standard operating range, mapping monitoring indicators of different dimensions to a unified numerical range to obtain standardized time-series data.

[0006] In one implementation, the step of constructing a graph structure based on the physical coupling relationship between various monitoring indicators in time-series data includes: obtaining preset initial edge weights, wherein the initial edge weights are used to reflect the initial physical coupling strength between various monitoring indicators; during system operation, dynamically calculating the similarity between various monitoring indicators based on real-time data within a sliding time window, and obtaining dynamically updated edge weights that are adaptively updated over time based on the dynamic calculation results and the initial edge weights; using various monitoring indicators as graph nodes and the dynamic edge weights as connecting edges between various graph nodes to construct a graph structure that reflects the evolution of multivariate coupling relationships in real time.

[0007] In one implementation, the step of generating simulated positive and negative samples by performing self-supervised perturbation training on the graph structure includes: applying a first perturbation to the original nodes or edges in the graph structure to simulate the abnormal state and various operating conditions of the data layer, thereby obtaining a first positive sample and a first negative sample; and applying a second perturbation to the node embedding features in the graph structure to simulate the abnormal state and various operating conditions of the coupling relationship layer, thereby obtaining a second positive sample and a second negative sample.

[0008] In one implementation, the step of optimizing the latent feature space based on the prediction vector, positive samples, and negative samples to obtain an enhanced coupling sensitivity vector includes: inputting the prediction vector, the features corresponding to the first positive sample and the first negative sample, and the features corresponding to the second positive sample and the second negative sample into the contrastive loss model for calculation, so that the features corresponding to the prediction vector are clustered together in the latent feature space to obtain the enhanced coupling sensitivity vector.

[0009] In one implementation, the step of calculating the set of anomaly sensitivities based on the coupling sensitivity vector includes: calculating the feature differences between each node and its neighboring nodes based on the coupling sensitivity vector and the dynamic coupling weights between nodes to obtain the local coupling sensitivity; calculating the degree of deviation of each node relative to the overall operating state of the system based on the Euclidean distance between the coupling sensitivity vector and the global feature center to obtain the global coupling sensitivity; and standardizing the deviation between the actual observed value of the time series data and the predicted value corresponding to the prediction vector, combined with a preset standard deviation, to obtain the univariate dynamic sensitivity.

[0010] In one implementation, the step of determining the target anomaly detection result based on the multi-scale coupled anomaly score includes: acquiring the temporal prediction error, fusing the multi-scale coupled anomaly score and the temporal prediction error to obtain a comprehensive anomaly score; performing adaptive threshold adjustment based on the comprehensive anomaly score within a historical sliding window to determine the anomaly judgment threshold at the current moment, comparing the comprehensive anomaly score with the anomaly judgment threshold to determine the anomaly level at the current moment based on the comparison result, and outputting anomaly warning information.

[0011] Secondly, embodiments of the present invention also provide a small-sample cold source system anomaly detection device based on graph neural networks. The device includes: a graph structure modeling module, which processes multi-source monitoring data of the cold source system to obtain standardized time-series data, and constructs a graph structure based on the physical coupling relationship between various monitoring indicators in the time-series data, so as to extract features from the graph structure through a graph neural network to obtain node embedding features; a self-supervised contrastive learning module, which performs time-series modeling processing on the node embedding features through a long short-term memory network to obtain a prediction vector, and generates simulated positive and negative samples by performing self-supervised perturbation training on the graph structure, so as to optimize the potential feature space based on the prediction vector, positive samples, and negative samples to obtain an enhanced coupling sensitivity vector; and an anomaly determination and early warning module, which calculates an anomaly sensitivity set based on the coupling sensitivity vector, and performs weighted fusion processing on various anomaly sensitivities in the anomaly sensitivity set to obtain a multi-scale coupling anomaly score, so as to determine the target anomaly detection result based on the multi-scale coupling anomaly score, wherein the anomaly sensitivity set includes: local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity.

[0012] Thirdly, embodiments of the present invention also provide a server, including a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement any of the methods provided in the first aspect.

[0013] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions, which, when invoked and executed by a processor, cause the processor to implement any of the methods provided in the first aspect.

[0014] The embodiments of the present invention bring the following beneficial effects: This invention provides a method and apparatus for anomaly detection in a small-sample cold source system based on graph neural networks. The method first processes multi-source monitoring data of the cold source system to obtain standardized time-series data. Then, it constructs a graph structure based on the physical coupling relationships between various monitoring indicators in the time-series data. A graph neural network is used to extract features from the graph structure, obtaining node embedding features. Subsequently, a long short-term memory network is used to perform time-series modeling on the node embedding features to obtain prediction vectors. Finally, simulated positive and negative samples are generated through self-supervised perturbation training of the graph structure. Based on the prediction vectors, positive samples, and negative samples, the system detects anomalies in a small-sample cold source system. The latent feature space is optimized to obtain an enhanced coupling sensitivity vector. Finally, an anomaly sensitivity set is calculated based on the coupling sensitivity vector, and the anomaly sensitivities of each item in the anomaly sensitivity set are weighted and fused to obtain a multi-scale coupling anomaly score. Based on the multi-scale coupling anomaly score, the target anomaly detection result is determined. This invention can be applied to fault identification, trend warning, and health management of cold source systems under small sample conditions. It can simultaneously capture the dynamic coupling relationship and time series trend characteristics between multiple variables, thereby achieving early detection and interpretable analysis of weak anomalies and significantly improving the sensitivity of anomaly detection in cold source systems.

[0015] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0016] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1A flowchart illustrating a method for detecting anomalies in a small-sample cold source system based on a graph neural network, provided in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the specific process of a small-sample anomaly detection method for a cold source system based on a graph neural network, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of a small-sample cold source system anomaly detection device based on graph neural networks provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a server provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Currently, the nuclear power plant's cooling system is a crucial support for the safe operation of nuclear power units. Its operational status monitoring and anomaly early warning primarily rely on parameter data collected by the operation monitoring system, including multi-dimensional information such as pump flow rate, pump current, voltage, inlet and outlet water temperature, pump outlet pressure, water level, and vibration. Related technologies suggest that commonly used anomaly detection methods in the industry mainly fall into three categories: First, manual rules and static threshold judgments, where an alarm is triggered when a monitored parameter exceeds a set upper limit. However, this type of method relies heavily on experience, making it difficult to adapt to multi-variable coupling and slow-trending anomalies, and is prone to false alarms or missed alarms. Second, supervised machine learning models, such as decision trees, support vector machines, and neural networks, etc. The method requires a large number of labeled normal and abnormal samples for training. However, cold source systems have high operational reliability, real fault samples are extremely rare, and the labeling cost is high, which limits the practical application of this type of method. Thirdly, traditional unsupervised detection algorithms, such as clustering, isolated forests, and principal component analysis, are insufficient in modeling multivariate dynamic coupling relationships and time series trends, have limited generalization ability, and are difficult to capture weak trend anomalies. In addition, cold source systems often exhibit weak trend anomalies before anomalies occur, that is, the monitoring indicators have not yet exceeded the threshold but coupling shifts have already occurred. Existing technologies generally lack the ability to identify such pre-fault symptoms, making it difficult to achieve effective early warning.

[0021] Based on this, the method and apparatus for detecting anomalies in a small sample cold source system based on graph neural networks provided by this invention can capture the nonlinear dependencies between multiple variables in the graph structure space and combine it with temporal feature embedding to achieve highly sensitive detection and interpretable analysis of weak trend anomalies in the cold source system, thereby significantly improving the sensitivity of anomaly detection in the cold source system.

[0022] See Figure 1 The diagram shows a flowchart of a small-sample anomaly detection method for a cold source system based on a graph neural network. The method mainly includes the following steps S102 to S106: Step S102: Data processing is performed on the multi-source monitoring data of the cold source system to obtain standardized time-series data. A graph structure is constructed based on the physical coupling relationship between various monitoring indicators in the time-series data. The graph structure is then processed by a graph neural network to extract features and obtain node embedding features.

[0023] In one implementation, firstly, multi-source monitoring data of the cooling source system is acquired. This data originates from sensors deployed at various key locations within the cooling source system, specifically including: flow sensors installed on the inlet and outlet pipes of the cooling water pump to collect pump flow data; current and voltage transformers installed in the pump motor circuit to collect pump current and voltage signals; pressure transmitters installed on the pump outlet pipe to collect pump outlet pressure; temperature sensors installed at the inlet and outlet of the cooling source system to collect inlet and outlet water temperatures; vibration sensors installed at the pump bearing location to collect pump vibration data; and level gauges installed in the cooling water tank to collect water level data. All sensors collect data according to a set sampling frequency.

[0024] After acquiring the raw monitoring data, data preprocessing is required to obtain standardized time-series data. Since sensors may experience signal interruptions or acquisition errors during long-term operation, the raw data often contains missing and outlier values. For short-term data gaps, linear interpolation is used for repair; that is, a linear fit is performed based on the data values ​​before and after the missing point to calculate the estimated value of the missing time for filling. For long-term continuous data gaps, considering that interpolation repair may cause data distortion, the complete time-series window containing the long-term missing data is directly removed. For abnormal jump points that may occur during acquisition, the three-standard-deviation principle is used for identification and removal. That is, the mean and standard deviation of each monitoring indicator within the local window are calculated, and sampling points exceeding three times the mean standard deviation are identified as acquisition error points and removed, thus obtaining cleaned monitoring data.

[0025] After data cleaning, since different monitoring indicators have different physical dimensions, directly using the original values ​​for model training will lead to the training process being dominated by features with larger dimensions. Therefore, it is necessary to normalize the cleaned monitoring data. This invention adopts a normalization method based on physical upper and lower limits. According to the physical upper and lower limits of each monitoring indicator within the normal operating range of the equipment, the original values ​​are mapped to a unified numerical range of 0 to 1, so that monitoring indicators with different dimensions can be compared and calculated on the same scale, resulting in standardized time series data.

[0026] After obtaining standardized time-series data, a graph structure reflecting the physical coupling relationships between multiple variables needs to be constructed. In a cold source system, the various monitoring indicators are not independent but have complex physical coupling relationships. For example, there is a positive correlation between pump current and pump flow rate, and a correlation between inlet / outlet water temperature difference and cooling efficiency. This invention treats each monitoring indicator as a node in the graph structure, and the connecting edges between nodes reflect the physical coupling relationships between the indicators. Specifically, the Pearson correlation coefficient between each monitoring indicator is calculated based on historical operating data, and these correlation coefficients are used as the initial edge weights of the graph structure. During system operation, the similarity between monitoring indicators is recalculated based on real-time data within each sliding time window, and the dynamic calculation results are weighted and fused with the historical edge weights to obtain dynamic edge weights that are adaptively updated over time. Finally, using each monitoring indicator as a graph node and the dynamic edge weights as the connecting edges between nodes, a dynamic graph structure that can reflect the evolution of multivariate coupling relationships in real time is constructed.

[0027] After constructing the graph structure, standardized time-series data is input into a graph neural network for feature extraction. The graph neural network, through convolutional operations on the graph structure, aggregates information from each node's neighbors. After stacking multiple layers of graph convolutional networks, the embedded features of each node not only contain its own attribute information but also incorporate coupling information from neighboring nodes and global graph structure features. Through this feature extraction process, the final output is node embedding features that comprehensively reflect the complex coupling relationships between multiple variables, providing high-quality feature input for subsequent time-series modeling and anomaly detection.

[0028] Step S104: The node embedding features are processed by temporal modeling through a long short-term memory network to obtain a prediction vector. Simulated positive and negative samples are generated by self-supervised perturbation training on the graph structure. Based on the prediction vector, positive and negative samples, the latent feature space is optimized to obtain an enhanced coupling sensitive vector.

[0029] In one implementation, the node embedding features output by the graph neural network are first input into a long short-term memory network for time series modeling. The node embedding features are time series sequences organized in the form of sliding windows, with each time window containing node embedding vectors from multiple time points. The long short-term memory network can effectively capture short-term fluctuations and long-term trends in the time series. When processing the node embedding feature sequence, the network reads the input step by step and continuously updates its state, ultimately outputting a prediction vector.

[0030] While obtaining the prediction vector, the graph structure needs to be trained with self-supervised perturbation to generate simulated positive and negative samples. The self-supervised perturbation training is carried out at two levels to comprehensively simulate different types of abnormal states and operating conditions. The first level is data layer perturbation, which involves applying slight perturbations to the original node values ​​or edge weights in the graph structure. For example, in node value perturbation, the value of a certain monitoring indicator is randomly increased or decreased by a small amount within the normal range to simulate the situation where the sensor reading deviates slightly from the normal state. In edge weight perturbation, the connection weights between two nodes are slightly adjusted to simulate the situation where the coupling relationship between two monitoring indicators changes slightly. Through this data layer perturbation, the first positive sample simulating abnormal states of the data layer is generated. At the same time, original data is sampled from different time windows. These data represent the normal operating state of the system under different loads, seasons, and other conditions, and serve as the first negative sample simulating different operating conditions.

[0031] The second layer is the coupling relationship layer perturbation. Specifically, it applies guided perturbations based on neighbor information to the node embedding features output by the graph neural network. Unlike the random perturbations in the data layer, the coupling relationship layer perturbations are directional. That is, the node embeddings are adjusted in a directional manner based on the feature information of the current node's neighbors. For example, for a given node, the feature differences between it and all its neighbors are calculated, and then the node embedding is fine-tuned along the direction that decreases or increases these differences, thereby simulating a slight change in the coupling relationship between the node and its neighborhood. Through this neighbor-information-based guided perturbation, a second positive sample simulating abnormal states of the coupling relationship layer is generated. Simultaneously, embedding features are sampled from different time windows or different nodes. These features represent normal coupling patterns between multiple variables under different operating states, serving as a second negative sample simulating different coupling relationship conditions.

[0032] After generating positive and negative samples, the features of the normal samples corresponding to the predicted vectors, the features corresponding to the first positive and first negative samples, and the features corresponding to the second positive and second negative samples are jointly input into the contrastive loss model for optimization. The design goal of the contrastive loss model is to make samples of the same class closer together in the latent feature space and samples of different classes farther apart. Specifically, for normal sample features, the optimization goal is to make them cluster together to form compact clusters; for the features of the first and second positive samples, the optimization goal is to make them move closer to normal sample features while maintaining a certain degree of discrimination; for the features of the first and second negative samples, the optimization goal is to separate them from normal sample features. Through this contrastive learning optimization, the model's feature extraction capability is significantly enhanced, and the final output coupling-sensitive vector has higher sensitivity to weak anomalies in both the data layer and the coupling relationship layer, providing higher-quality feature input for subsequent anomaly scoring.

[0033] Step S106: Calculate the anomaly sensitivity set based on the coupling sensitivity vector, and perform weighted fusion processing on each anomaly sensitivity in the anomaly sensitivity set to obtain a multi-scale coupling anomaly score. Based on the multi-scale coupling anomaly score, determine the target anomaly detection result. The anomaly sensitivity set includes: local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity.

[0034] In one implementation, firstly, anomaly sensitivity is calculated in three dimensions based on the enhanced coupling sensitivity vector, assessing the degree of system anomaly from three perspectives: local coupling, global state, and univariate prediction. The calculation of local coupling sensitivity focuses on reflecting the dynamic correlation anomalies between each monitoring indicator and its neighboring nodes. For each node in the graph structure, the dynamic coupling weights between the node and all its neighbors are first obtained. These weights are determined by the physical dependencies and temporal correlations between nodes. Then, the feature differences between the node's coupling sensitivity vector and the coupling sensitivity vectors of each neighboring node are calculated, typically using Euclidean distance or cosine distance as the difference measure. The feature differences of each neighboring node are multiplied by the dynamic coupling weight corresponding to the node, weighted, summed, and then averaged by the number of neighboring nodes to obtain the node's local coupling sensitivity. The larger this sensitivity value, the greater the deviation of the coupling relationship between the node and its neighbors from the normal pattern.

[0035] The calculation of global coupling sensitivity focuses on evaluating the degree of deviation of each node from the overall system operating state. First, the mean of the coupling sensitivity vectors of all nodes within the current time window is calculated to obtain the global feature center, which represents the current overall system operating state. Then, the Euclidean distance between the coupling sensitivity vector of each node and the global feature center is calculated; this distance value is the global coupling sensitivity of that node. The larger the sensitivity value, the greater the degree to which the node's operating state deviates from the overall system state.

[0036] The calculation of univariate dynamic sensitivity focuses on characterizing the prediction bias of each monitoring indicator's time series. The prediction vector output by the Long Short-Term Memory (LSTM) network is obtained, and the predicted value for each monitoring indicator is extracted from it. Simultaneously, the actual observed value of the monitoring indicator is obtained, and the absolute deviation between the two is calculated. To eliminate the influence of differences in the dimensions of different indicators, this absolute deviation is standardized by dividing it by the standard deviation of the indicator during its historical normal operation phase, yielding the univariate dynamic sensitivity of that node. The larger this sensitivity value, the more significant the time series prediction bias of the indicator.

[0037] After calculating the anomaly sensitivity across the three dimensions, a weighted fusion process is required. Based on the characteristics of the cold source system at different operational stages, weight coefficients can be assigned to the local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity. For example, during stable system operation, the weight of coupling-related sensitivity can be appropriately increased to more sensitively capture weak coupling anomalies; when system fluctuations are significant, the weight of univariate dynamic sensitivity can be appropriately increased to focus more on direct prediction biases. The multi-scale coupling anomaly score for each node is obtained by multiplying the three sensitivity values ​​of each node by their corresponding weight coefficients and then summing them.

[0038] Finally, the target anomaly detection result is determined based on the multi-scale coupled anomaly score. By combining the anomaly scores of all nodes, the overall anomaly level of the entire system can be obtained. When the anomaly score of a node exceeds a preset threshold, the monitoring indicator corresponding to that node is determined to be abnormal; when the anomaly scores of multiple nodes rise simultaneously, the system is determined to have a multivariate coupled anomaly. Simultaneously, the judgment threshold is dynamically adjusted based on the anomaly score distribution within a historical sliding window, allowing the warning standard to adaptively adjust with changes in system operating conditions. The final output includes anomaly level, anomaly node information, and anomaly timestamps, providing decision-making support for operations and maintenance personnel.

[0039] The above-mentioned small-sample cold source system anomaly detection method based on graph neural network provided in this invention can solve the problems of scarce abnormal samples, poor model robustness and insufficient early warning capability in cold source system anomaly detection. By combining graph neural network with time series modeling, it directly captures the dynamic coupling relationship between multiple variables, realizes accurate modeling of the cold source system's operating status and early detection of abnormal trends, and significantly improves the sensitivity of cold source system anomaly detection.

[0040] See Figure 2 The diagram shows a specific flowchart of a small-sample cold source system anomaly detection method based on graph neural networks. This embodiment of the invention also provides an implementation method for anomaly monitoring of a cold source system, thereby achieving high-precision anomaly identification under small-sample conditions for potential early weak anomaly features during cold source operation. See (1) to (6) below for details: (1) Preprocessing and physical normalization of cold source system operation data: The sampling frequency of monitoring data is set to 1 minute / time, including the following parameters:

[0041] Where t represents the time index. Cooling water pump flow rate Pump current, Pump voltage, Pump outlet pressure, Inlet water temperature, Outlet water temperature, Water level, Pump vibration.

[0042] To maintain temporal integrity, a sliding window slicing strategy is used to construct training samples, with a window length of L and a step size of s. For the time series { , ,…, Generate a sample set:

[0043] In one implementation, short-term missing data in multi-source monitoring data is repaired by linear interpolation, and time-series windows corresponding to long-term missing data are removed to obtain a complete and continuous monitoring sequence. Then, acquisition error points in the monitoring sequence are removed to obtain cleaned monitoring data. Finally, the cleaned monitoring data is normalized according to the physical upper and lower limits of each monitoring indicator within a preset standard operating range, mapping monitoring indicators of different dimensions to a unified numerical range to obtain standardized time-series data. In the above data processing, missing value processing, outlier processing, and physical normalization processing are required.

[0044] Missing value handling: Linear interpolation is used to repair small missing values ​​(i.e., short-term missing segments), while windows are removed for long-term missing data to ensure the integrity of the input samples.

[0045] Outlier handling: Eliminate possible data collection error points using the three-standard-deviation principle.

[0046] Physical normalization: Due to the significant differences in the dimensions of different monitored quantities, a normalization method based on the upper and lower limits of physical quantities is adopted to avoid feature bias during model training.

[0047] in, It is the physical value of the time index t corresponding to monitoring indicator i. It is the normalized physical value of the time index t corresponding to monitoring indicator i. It is the physical minimum value of monitoring indicator i. It is the physical maximum value of monitoring indicator i. and This method is obtained through long-term operational data statistics. Compared to simple statistical normalization, it is more interpretable and stable in the field of nuclear power cooling sources, and is particularly adaptable to differences between different units.

[0048] (2) Graph Neural Network Feature Extraction and Temporal Embedding Modeling: In order to fully capture the complex dynamic coupling relationship between multiple variables in the cold source system, a graph structure is constructed, node embedding is extracted, and short-term fluctuation and long-term trend features are obtained through a time series model. First, the preset initial edge weights are obtained. Then, during the system operation, the similarity between various monitoring indicators is dynamically calculated based on the real-time data within the sliding time window. According to the dynamic calculation results and the initial edge weights, the dynamic edge weights that are updated adaptively over time are obtained. Finally, each monitoring indicator is used as a graph node, and the dynamic edge weights are used as the connecting edges between the graph nodes to construct a graph structure that reflects the evolution of the multivariate coupling relationship in real time. The initial edge weights are used to reflect the initial physical coupling strength between various monitoring indicators.

[0049] (2-1) Graph Structure Construction: Each monitoring indicator of the cold source system is considered as a graph node, and edges are established between nodes to reflect the physical coupling relationship between variables and operational experience. Initial edge weights. Calculated from historical data, determined by the Pearson correlation coefficient between indicators:

[0050] in, This is a function of physical coupling strength. Let i be the normalized physical value of the monitoring index i. , is the normalized physical value of monitoring indicator j.

[0051] During operation, edge weights can be adaptively updated, capturing dynamic coupling characteristics:

[0052] in, Let be the similarity measurement function between indicators i and j within the current time window. This is a smoothing coefficient that allows adjustment of the weighting between historical information and real-time data. and These represent the monitoring indicators (nodes). and At any moment The normalized eigenvectors.

[0053] (2-2) Graph Neural Network Embedding: Based on the graph structure described above, a Graph Convolutional Network (GCN) is used to extract node features. The embedding update formula for each layer is as follows:

[0054] in, For the first Layer nodes eigenvectors, Represents a node The neighborhood group, Attention weights reflect the node's... right The degree of dependence, For a trainable parameter matrix, is the activation function. Through multi-layer stacking, node embedding not only includes local neighbor information but also incorporates global graph structure features, thereby effectively capturing complex static coupling relationships among multiple variables.

[0055] (2-3) Temporal embedding modeling: embedding the nodes output by the graph neural network into a matrix. ( For the number of nodes, (For the embedding dimension) are input sequentially into a Long Short-Term Memory (LSTM) network to generate prediction vectors. :

[0056] Among them, the LSTM module can capture both short-term fluctuations and long-term trends. Through time series modeling, the system can extract weak trend anomaly signals and retain multivariate coupling information in the latent space, providing highly sensitive features for subsequent anomaly detection.

[0057] (2-4) Self-supervised training and few-shot augmentation: To address the scarcity of real abnormal samples in the cold source system, self-supervised graph perturbation training is introduced. A first perturbation is applied to the original nodes or edges in the graph structure to simulate abnormal states and various operating conditions of the data layer, obtaining the first positive and first negative samples. Specifically, a slight perturbation is applied to nodes or edges to generate positive and negative samples (the first positive and first negative samples). The latent space is optimized by minimizing the loss function that minimizes the clustering of normal sample embeddings and the separation of abnormal sample embeddings.

[0058] in, Embedding of positive samples generated after perturbation. For negative sample embedding, K is the number of negative samples. This strategy enhances the model's ability to detect weak anomalies under small sample conditions and improves the interpretability of the latent space.

[0059] This invention achieves multivariate dynamic dependency capture by combining graph structure coupling, graph neural network embedding, and time series prediction. Compared with traditional autoencoders, this method has the following advantages: it can explicitly model the physical coupling relationship between indicators; it can capture composite abnormal signals of short-term fluctuations and long-term trends; it supports self-supervised training under small sample conditions, improving the sensitivity of anomaly detection; and the latent space embedding is interpretable, can trace the source of anomalies, and facilitates operation and maintenance decisions.

[0060] (3) Graph-enhanced dynamic coupling feature extraction: In order to break through the limitation that traditional graph neural networks can only capture static neighborhood information, a graph-enhanced dynamic coupling feature extraction mechanism is proposed. Through cross-node attention and temporal collaborative modeling, the adaptive characterization of multivariable coupling relationships is realized.

[0061] (3-1) Dynamic Coupling Vector Generation: Based on the node embeddings obtained from the graph neural network, a dynamic coupling adaptive mechanism is introduced to generate coupling-sensitive vectors. This is used to capture anomalies in weak coupling between multiple variables. The specific formula is as follows:

[0062] Wherein, the attention weight of node i to its neighbor node j Defined as:

[0063] in, This represents the gradient of node i's change within the current time window, reflecting short-term dynamic trends. This is the physical coupling strength function, defined based on system operating conditions and physical model; For custom nonlinear mapping functions; Weigh the contributions of dynamic change and physical coupling; It is a trainable matrix.

[0064] This mechanism makes the coupling vector more sensitive to subtle trend anomalies and multivariate coupling anomalies by integrating the node's own changes and the dynamic information of its neighbors.

[0065] (3-2) Coupling Perturbation Self-Supervised Training: To address the problem of abnormally scarce small samples, a second perturbation is applied to the node embedding features in the graph structure to simulate the abnormal state and various operating conditions of the coupling relationship layer, resulting in a second positive sample and a second negative sample. Then, the predicted vector, the features corresponding to the first positive sample and the first negative sample, and the features corresponding to the second positive sample and the second negative sample are input into the contrastive loss model for calculation and processing, so that the features corresponding to the predicted vector are clustered in the latent feature space, resulting in an enhanced coupling-sensitive vector. Specifically, by introducing a coupling perturbation self-supervised strategy, a second positive sample is generated by applying a neighbor-guided perturbation to the node embedding. Simultaneously, samples are taken from other time windows or nodes to generate a second negative sample. This forms a contrastive training signal:

[0066] in, To determine the disturbance amplitude, control the disturbance intensity; The coupling sensitivity weight of neighbor j to node i can be dynamically calculated using historical data; the second positive sample Simulating potential weak anomalies, second negative sample Simulate different operating conditions of the system. Represents a node The set of neighboring nodes, that is, the set of nodes in the graph structure that are related to the node. There exists a set of all nodes connected by an edge; The number of elements in the set; For nodes Embedded feature vectors, Representing neighboring nodes With nodes The difference vectors between embedded features are used to characterize the relative direction and magnitude of their changes in the feature space.

[0067] The contrastive loss function is defined as:

[0068] in, This is a temperature coefficient used to control the smoothness of the distribution of similarity between positive and negative samples in the contrast loss. The smaller the value, the more sensitive the model is to differences in similarity. Represents a node The feature vectors mapped by the projection head are used to calculate the comparison similarity. The similarity function between two vectors can be defined using cosine similarity, and its expression is as follows:

[0069] in, These represent the eigenvectors.

[0070] By generating positive and negative samples through perturbation, the model can learn the features for distinguishing normal and abnormal patterns under small sample conditions without additional labeling.

[0071] (3-3) Multi-scale latent space optimization: To further improve the sensitivity and interpretability of anomaly detection, the coupled embedding vectors are optimized. Multi-scale latent space optimization is performed. The optimization objective consists of three parts: 1. Normal sample clustering: Minimize the embedding distance of normal samples under the same working conditions, so that the latent space is clustered with normal states.

[0072] 2. Coupled Stretching of Abnormal Samples: Coupled stretching is performed on abnormal samples to obtain stretching information. The stronger the coupling between anomaly samples and normal samples, the further their embedding is pulled in the latent space. The calculation formula is as follows:

[0073] in, Let be the coupling strength between node i and the abnormal sample k; is the coupling weight coefficient; m is the minimum interval threshold.

[0074] 3. Based on the contrastive loss function, aggregation information, and stretching information, construct the overall optimization objective. Its expression is as follows:

[0075] Wherein, λ1 and λ2 are the weight coefficients of the normal sample aggregation term and the abnormal sample stretching term, respectively, used to balance the influence of each loss term on the overall optimization objective.

[0076] Through this optimization strategy, the model can simultaneously capture univariate minor anomalies and multivariate coupled anomalies, obtaining a coupling sensitivity vector, which can significantly improve the early warning capability of cold source systems and provide interpretable anomaly factor analysis.

[0077] (4) Multivariate coupling anomaly sensitivity modeling: First, based on the coupling sensitivity vector and the dynamic coupling weight between nodes, the feature difference between each node and its neighboring nodes is calculated to obtain the local coupling sensitivity. Then, based on the Euclidean distance between the coupling sensitivity vector and the global feature center, the deviation of each node from the overall system operation state is calculated to obtain the global coupling sensitivity. Finally, based on the deviation between the actual observed value of the time series data and the predicted value corresponding to the prediction vector, the standardization process is combined with the preset standard deviation to obtain the univariate dynamic sensitivity.

[0078] (4-1) Multi-scale coupling anomaly scoring: based on coupling sensitivity vector This paper proposes a multi-scale coupled anomaly sensitivity modeling method to comprehensively evaluate anomaly characteristics at different levels in a cold source system. The model calculates anomaly sensitivity from three dimensions: 1. Local coupling sensitivity : Reflects short-term dynamic anomalies in the association between a node and its neighborhood, defined as:

[0079] in, The dynamic coupling weights in the graph structure are determined by both the physical dependencies and temporal correlations between nodes.

[0080] in, For the Sigmoid function, Indicates the correlation of the original signal. Indicates graph embedding similarity; , These are weighting coefficients, which control the contribution ratios of the physical relevance term and the embedding similarity term in the coupling weight calculation, respectively.

[0081] 2. Global Coupling Sensitivity : Used to evaluate the degree of deviation of a node from the global state distribution, the calculation formula is:

[0082] Among them, global feature center The mean of the coupling sensitivity vectors of all nodes is denoted as . The further the node embedding deviates from the global center, the higher the degree of abnormality in its global operating state.

[0083] 3. Univariate dynamic sensitivity : Used to characterize the prediction bias of a node's own time series, defined as:

[0084] in, The actual observed values ​​of the time series data and the predicted values ​​of the time series model are given. The predicted value is the value corresponding to the predicted vector. This represents the standard deviation of this feature during the normal historical period.

[0085] Furthermore, the three types of sensitivity are combined to form a multi-scale coupling anomaly score for the node:

[0086] in, , , This is a weighting coefficient that can be adaptively adjusted based on the complexity of the working conditions or the importance of the nodes.

[0087] (4-2) Calculation of comprehensive anomaly score: In order to achieve overall anomaly determination, the anomaly score is coupled with the time series prediction error. The results are obtained by merging the scores to obtain a comprehensive anomaly score. The calculation formula is as follows:

[0088] in, This refers to the time series prediction error; These are the mean and standard deviation of the historical normal error, respectively; This is a statistic for coupling anomaly scoring; The dynamic fusion coefficients control the weights of error and coupling information. This is a vector of monitoring indicators based on historical sequence predictions, i.e., time... The time series model prediction values.

[0089] When the system state is stable, the model relies more on coupling characteristics ( Anomaly identification is performed; when the system fluctuates significantly, the model is enhanced to be more sensitive to direct prediction bias, thus balancing robustness and early warning capabilities.

[0090] (4-3) Anomaly tracking and interpretation analysis: To achieve anomaly interpretability and tracking analysis, the model calculates the contribution of monitoring indicators based on attention weights and coupling strength. To track abnormal factors and monitor the contribution of indicators The calculation formula is as follows:

[0091] Overall Anomaly Contribution Value of Nodes The expression is as follows:

[0092] in, This indicates "the extent to which one's abnormality is"; This indicates "who among the neighbors is behaving strangely"; Representing neighboring nodes The abnormal sensitivity of a node is used to measure its abnormality. The intensity of the impact of anomalies on its associated nodes; the reason for adopting Instead This is to reflect the propagation and coupling relationship of anomalies between nodes, thereby enabling the interpretable location of the anomaly source.

[0093] Therefore, the overall abnormal contribution value is ranked by indicators. This technology can identify the dominant anomaly node and its associated links, enabling visualization of the anomaly propagation path. This mechanism allows the invention to pinpoint potential source variables and their impact range after an anomaly is detected, providing an interpretable basis for decision-making in the operation and maintenance of cold source systems.

[0094] (5) Anomaly detection and adaptive threshold alarm strategy: Obtain the time series prediction error, and fuse the multi-scale coupled anomaly score and the time series prediction error to obtain a comprehensive anomaly score. Then, perform adaptive threshold adjustment based on the comprehensive anomaly score in the historical sliding window to determine the anomaly detection threshold at the current time. Compare the comprehensive anomaly score with the anomaly detection threshold to determine the anomaly level at the current time based on the comparison result, and output anomaly warning information.

[0095] Specifically, firstly at each moment Extract the node embedding vector Its expression is as follows:

[0096] in, :time The embedding vector of the first node is generated by the graph neural network encoder and is used to represent the state features of the node.

[0097] Subsequently, based on the length of the time window Use the step size to construct window samples Its expression is as follows:

[0098] After training, the reconstruction error is calculated for the newly input window samples. The calculation formula is as follows:

[0099] in, Window Sample The model reconstruction output is used to calculate the reconstruction error.

[0100] Then combine the latent space similarity score (i.e., the cosine similarity between this sample and its nearest normal neighbor sample), construct the comprehensive anomaly score:

[0101] in, , These are the mean and standard deviation of the reconstruction error, respectively (calculated based on historical normal data). The weighting coefficient was set to 0.6 after experimentation, which controls the weight of reconstruction error and similarity in anomaly detection.

[0102] In this embodiment, the method for setting the adaptive threshold strategy is as follows: The anomaly detection threshold is dynamically updated using a sliding statistical window (data from the past 7 days). The calculation formula is as follows:

[0103] in, The sliding window is the current time, and k is the sensitivity coefficient. Indicates a sliding window The mean of historical outlier scores, This represents the standard deviation of the corresponding scores.

[0104] when > When an abnormal trend is detected during a given time period, the abnormality level is output. (This is based on a dynamic threshold.) Based on this, three levels are set: mild, moderate, and emergency, for the operation and maintenance system to issue early warnings. The level settings are shown in Table 1 below: Table 1

[0105] Furthermore, the present invention can automatically generate alarms and push anomaly detection information to the terminal of operation and maintenance personnel. The anomaly detection information includes at least the anomaly level, time slice, and main characteristics.

[0106] (6) Online Adaptation and Edge Deployment: To ensure the long-term stable operation of the model and its rapid response capability, the system is designed with a feature drift detection and periodic retraining mechanism to respond promptly to changes in operating conditions. Edge node deployment is achieved through model lightweighting technology, supporting breakpoint resume functionality. Even when the network is interrupted, the detection continuity is maintained, and the latest model state is synchronized after communication is restored, ensuring the robustness and reliability of the system.

[0107] In practical applications, the process of anomaly detection of the power plant's cooling source system according to this invention is as follows: This embodiment takes the cooling source system of a nuclear power plant in Shandong Province as the application scenario. The cooling source system includes several cooling water pump stations and a cooling source circulation network with a total installed capacity of about 200MW. It is equipped with a unified monitoring system with a sampling cycle of 1 minute, and collects more than 30 operating parameters in real time, such as cooling water pump flow rate, pump current, voltage, pump outlet pressure, inlet and outlet water temperature, pump vibration, water level, pump frequency, pump shaft temperature, network pressure, and pump outlet temperature.

[0108] In this embodiment, the first step is to extract 180 consecutive days of operational data from the historical database of the cold source system, totaling approximately 5 million records. To address common issues in cold source systems such as sensor drift, localized signal interruptions, pump load fluctuations, and high-frequency noise caused by pipe network water flow interference, the following preprocessing strategy is adopted: Based on the cold source data processing model, forward imputation is used to repair univariate data with short-term missing values ​​(less than 5 minutes), while the corresponding time slice is discarded for data with long-term missing values, thus completing the repair of missing values.

[0109] To address the dimensional differences of different physical quantities, such as the unit of flow rate... The unit of current is The temperature is A grouping normalization strategy is adopted to normalize flow-related features to the [0,1] interval, and temperature features are normalized according to the physical upper and lower limits of operational experience. The calculation formula is as follows:

[0110] in, These are the physical values ​​of the monitoring indicators. It is the normalized physical value of the monitoring indicator. and These are the empirical lower and upper limits of the physical quantity within the normal operating range of the equipment, respectively.

[0111] Based on window length (i.e., 60-minute data) and step length ( (minutes), construct time series segments and sliding windows to ensure that the model can capture both short-term fluctuations and slow-changing trends.

[0112] The second step involves model training and anomaly detection based on the preprocessed monitoring data, which specifically includes the following: The preprocessed data is input into the graph neural network model, the time series embedding model, and the coupled trend simulation model for joint training.

[0113] Construct a node embedding matrix using a graph neural network model. Then, input it into the time series embedding model to extract weak trends and long-term coupling features, and obtain multivariate weak coupling information.

[0114] Feature extraction of weak coupling information from multiple variables is performed using a coupling trend simulation model to generate a coupling sensitivity vector. It is used to capture weak coupling anomalies among multiple variables and to calculate anomaly scores. The calculation formula is as follows:

[0115] in, For time series prediction error, , These represent the mean and standard deviation of the reconstruction error, respectively. To reconstruct the standardized error values, For potential spatial similarity deviation, For coupling anomaly deviation, , , ; The latent space similarity score represents the degree of similarity between the current window sample and historical normal samples in the latent feature space, calculated using cosine similarity. Coupling anomaly similarity score: Represents the multivariate coupling characteristics of the current sample. Similarity to historical normal coupling patterns is used to characterize the degree of abnormal deviation from weak coupling; the smaller the value, the greater the abnormal deviation.

[0116] The third step involves the cold source anomaly detection model setting an adaptive threshold based on historical distribution. The calculation formula is as follows:

[0117] in, This represents the mean of historical outlier scores. This represents the standard deviation of the corresponding scores. , This data was obtained from statistics of sliding window data over the past 7 days.

[0118] Anomalies are classified into different levels based on anomaly scores and adaptive thresholds. The anomaly levels can be found in Table 1.

[0119] when When an anomaly occurs, the present invention automatically triggers an anomaly alarm and pushes the anomaly time slice and related characteristics to the maintenance personnel's terminal.

[0120] The fourth step is to deploy the model algorithm on edge nodes. Each edge computing node where the pump station control unit is located deploys a lightweight model to receive monitoring data streams in real time and calculate the anomaly score of the latest 1-hour window every minute. When the network is interrupted, edge nodes can independently run the detection process and cache abnormal events. After the network is restored, they automatically synchronize with the central server to ensure data integrity.

[0121] At the same time, an online adaptive mechanism is set up to dynamically update the mean by sliding the historical distribution (window length is the past 7 days). and standard deviation The threshold is adaptively adjusted. During operation, the model employs a weekly incremental fine-tuning and quarterly full retraining update strategy. The incremental phase uses the last 30 days of normal data for small-step fine-tuning; the full phase retrains based on the last 90 days of data, updating the parameters of the graph neural network and coupling enhancement module. After each model update, the anomaly score distribution parameters are reassessed, and the dynamic threshold is synchronized to the edge nodes to ensure the consistency and stability of the early warning model.

[0122] Furthermore, to verify the feasibility of the present invention, historical operational data was processed using the present invention, and several representative anomalies were selected from the processing results. Anomaly scores and warning statuses were recorded, as shown in Table 2 below: Table 2

[0123] The experimental data show that the present invention can sensitively respond to weak anomalies of a single variable, and when multivariate coupled anomalies occur, the comprehensive anomaly score increases significantly, thus achieving early warning.

[0124] The fifth step involves real-time monitoring of the cooling system and outputting anomaly detection information, including: In May 2025, the outlet temperature of a certain pump station showed a slight increase under low load conditions (reconstruction error increased by 18% compared to normal), and the fluctuation range of cooling water flow increased. Edge nodes immediately calculate the anomaly score and trigger alarms, the central server synchronizes the information, and maintenance personnel confirm, 42 minutes after the anomaly occurred, that the pump outlet temperature control valve was partially stuck, resulting in low circulating water flow. Therefore, this invention issues an early warning approximately 4 hours in advance, avoiding the risk of a wider-ranging cooling system shutdown.

[0125] In summary, this invention effectively addresses the challenges of complex multivariate coupling and difficulty in identifying anomalies under small sample conditions in cold source system operation data by introducing a joint modeling mechanism of graph neural networks and temporal embedding. The graph-enhanced dynamic coupling feature extraction method adaptively captures the nonlinear dependencies between monitoring indicators in the graph structure space, achieving a joint expression of multivariate spatiotemporal features. Through cross-node attention mechanisms and coupling sensitivity vector generation, the model can characterize the evolutionary features of dynamic correlations in the cold source system, significantly improving the ability to perceive weak coupling anomalies. Based on a sensitivity modeling strategy using multi-scale coupling anomaly scoring, local disturbances, global pattern shifts, and univariate anomalies are comprehensively evaluated, allowing for interpretation and stabilization of anomaly identification results.

[0126] Regarding the anomaly detection method for small-sample cold source systems based on graph neural networks provided in the foregoing embodiments, this invention provides an anomaly detection device for small-sample cold source systems based on graph neural networks. (See [link]) Figure 3 The diagram shows a structural schematic of a small-sample cold source system anomaly detection device based on a graph neural network. The device includes the following parts: The graph structure modeling module 302 processes the multi-source monitoring data of the cold source system to obtain standardized time-series data, and constructs a graph structure based on the physical coupling relationship between various monitoring indicators in the time-series data. The graph structure is then processed by a graph neural network to extract features and obtain node embedding features. The self-supervised contrastive learning module 304 performs temporal modeling of node embedding features through a long short-term memory network to obtain a prediction vector. It also generates simulated positive and negative samples by performing self-supervised perturbation training on the graph structure. Based on the prediction vector, positive and negative samples, the latent feature space is optimized to obtain an enhanced coupling-sensitive vector. The anomaly detection and early warning module 306 calculates an anomaly sensitivity set based on the coupling sensitivity vector, and performs weighted fusion processing on each anomaly sensitivity in the anomaly sensitivity set to obtain a multi-scale coupling anomaly score. Based on the multi-scale coupling anomaly score, the target anomaly detection result is determined. The anomaly sensitivity set includes: local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity.

[0127] The small-sample cold source system anomaly detection device based on graph neural networks provided in this application embodiment can significantly improve the sensitivity of anomaly detection in cold source systems.

[0128] In one embodiment, when performing data processing on multi-source monitoring data of the cold source system to obtain standardized time-series data, the graph structure modeling module 302 is further configured to: perform linear interpolation repair on short-term missing data in the multi-source monitoring data, and remove the time-series windows corresponding to long-term missing data to obtain a complete and continuous monitoring sequence; remove the acquisition error points in the monitoring sequence to obtain cleaned monitoring data; and normalize the cleaned monitoring data according to the physical upper and lower limits of each monitoring indicator within the preset standard operating range, mapping monitoring indicators of different dimensions to a unified numerical range to obtain standardized time-series data.

[0129] In one embodiment, when constructing a graph structure based on the physical coupling relationship between various monitoring indicators in time-series data, the graph structure modeling module 302 is further configured to: obtain a preset initial edge weight, wherein the initial edge weight is used to reflect the initial physical coupling strength between various monitoring indicators; during system operation, dynamically calculate the similarity between various monitoring indicators based on real-time data within a sliding time window, and obtain a dynamic edge weight that is adaptively updated over time based on the dynamic calculation result and the initial edge weight; and construct a graph structure that reflects the evolution of multivariate coupling relationships in real time by using various monitoring indicators as graph nodes and the dynamic edge weight as the connecting edges between various graph nodes.

[0130] In one embodiment, when performing the step of generating simulated positive and negative samples by performing self-supervised perturbation training on the graph structure, the self-supervised contrastive learning module 304 is further configured to: apply a first perturbation to the original nodes or edges in the graph structure to simulate the abnormal state and various operating conditions of the data layer, thereby obtaining a first positive sample and a first negative sample; and apply a second perturbation to the node embedding features in the graph structure to simulate the abnormal state and various operating conditions of the coupling relationship layer, thereby obtaining a second positive sample and a second negative sample.

[0131] In one implementation, when performing the step of optimizing the latent feature space based on the prediction vector, positive samples, and negative samples to obtain the enhanced coupling sensitivity vector, the self-supervised contrastive learning module 304 is further used to: input the prediction vector, the features corresponding to the first positive sample and the first negative sample, and the features corresponding to the second positive sample and the second negative sample into the contrastive loss model for calculation, so that the features corresponding to the prediction vector are clustered together in the latent feature space to obtain the enhanced coupling sensitivity vector.

[0132] In one embodiment, when performing the step of calculating the anomaly sensitivity set based on the coupling sensitivity vector, the anomaly judgment and early warning module 306 is further configured to: calculate the feature differences between each node and its neighboring nodes based on the coupling sensitivity vector and the dynamic coupling weights between nodes to obtain the local coupling sensitivity; calculate the degree of deviation of each node relative to the overall system operating state based on the Euclidean distance between the coupling sensitivity vector and the global feature center to obtain the global coupling sensitivity; and perform standardization processing based on the deviation between the actual observed value of the time series data and the predicted value corresponding to the predicted vector, combined with a preset standard deviation, to obtain the univariate dynamic sensitivity.

[0133] In one embodiment, when performing the step of determining the target anomaly detection result based on the multi-scale coupled anomaly score, the anomaly determination and early warning module 306 is further configured to: acquire the time-series prediction error, and fuse the multi-scale coupled anomaly score and the time-series prediction error to obtain a comprehensive anomaly score; perform adaptive threshold adjustment processing based on the comprehensive anomaly score within the historical sliding window to determine the anomaly determination threshold at the current moment, and compare the comprehensive anomaly score with the anomaly determination threshold to determine the anomaly level at the current moment based on the comparison result, and output anomaly early warning information.

[0134] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0135] This invention provides a server, specifically, the server includes a processor and a storage device; the storage device stores a computer program, which, when run by the processor, executes the method described in any of the above embodiments.

[0136] Figure 4 This is a schematic diagram of the structure of a server provided in an embodiment of the present invention. The server 100 includes: a processor 40, a memory 41, a bus 42 and a communication interface 43. The processor 40, the communication interface 43 and the memory 41 are connected through the bus 42. The processor 40 is used to execute executable modules, such as computer programs, stored in the memory 41.

[0137] The memory 41 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 43 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0138] Bus 42 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0139] The memory 41 is used to store programs. After receiving an execution instruction, the processor 40 executes the program. The method executed by the device for defining the flow process disclosed in any of the foregoing embodiments of the present invention can be applied to the processor 40 or implemented by the processor 40.

[0140] Processor 40 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 40 or by instructions in software form. Processor 40 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 41. The processor 40 reads the information in memory 41 and, in conjunction with its hardware, completes the steps of the above method.

[0141] The computer program product of the readable storage medium provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the foregoing method embodiments. For specific implementation, please refer to the foregoing method embodiments, which will not be repeated here.

[0142] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0143] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for anomaly detection in a small-sample cold source system based on graph neural networks, characterized in that, The method includes: Data processing is performed on the multi-source monitoring data of the cold source system to obtain standardized time-series data. A graph structure is constructed based on the physical coupling relationship between various monitoring indicators in the time-series data. The graph structure is then processed by a graph neural network to extract features and obtain node embedding features. The node embedding features are processed by temporal modeling through a long short-term memory network to obtain a prediction vector. Simulated positive and negative samples are generated by self-supervised perturbation training on the graph structure. Based on the prediction vector, the positive and negative samples, the latent feature space is optimized to obtain an enhanced coupling-sensitive vector. An anomaly sensitivity set is calculated based on the coupling sensitivity vector, and a weighted fusion process is performed on each anomaly sensitivity in the anomaly sensitivity set to obtain a multi-scale coupling anomaly score. The target anomaly detection result is determined based on the multi-scale coupling anomaly score. The anomaly sensitivity set includes: local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity.

2. The method for anomaly detection in a small-sample cold source system based on graph neural networks according to claim 1, characterized in that, The steps for processing multi-source monitoring data from the cold source system to obtain standardized time-series data include: Linear interpolation is performed to repair short-term missing data in the multi-source monitoring data, and time-series windows corresponding to long-term missing data are removed to obtain a complete and continuous monitoring sequence. The acquisition error points in the monitoring sequence are removed to obtain cleaned monitoring data; Based on the physical upper and lower limits of each monitoring indicator within the preset standard operating range, the cleaned monitoring data is normalized to map monitoring indicators of different dimensions to a unified numerical range, thereby obtaining the standardized time-series data.

3. The method for anomaly detection in a small-sample cold source system based on graph neural networks according to claim 1, characterized in that, The step of constructing a graph structure based on the physical coupling relationships between various monitoring indicators in the time-series data includes: Obtain the preset initial edge weights, wherein the initial edge weights are used to reflect the initial physical coupling strength between each of the monitoring indicators; During system operation, the similarity between various monitoring indicators is dynamically calculated based on real-time data within the sliding time window, and dynamic edge weights that are adaptively updated over time are obtained based on the dynamic calculation results and the initial edge weights. By using each of the monitoring indicators as graph nodes and the dynamic edge weights as connecting edges between the graph nodes, a graph structure that reflects the evolution of multivariate coupling relationships in real time is constructed.

4. The method for anomaly detection in a small-sample cold source system based on graph neural networks according to claim 1, characterized in that, The step of generating simulated positive and negative samples by performing self-supervised perturbation training on the graph structure includes: A first perturbation is applied to the original nodes or edges in the graph structure to simulate the abnormal state and various operating conditions of the data layer, thereby obtaining the first positive sample and the first negative sample. A second perturbation is applied to the node embedding features in the graph structure to simulate the abnormal state and various operating conditions of the coupling relationship layer, thereby obtaining a second positive sample and a second negative sample.

5. The method for anomaly detection in a small-sample cold source system based on graph neural networks according to claim 1, characterized in that, The step of optimizing the latent feature space based on the predicted vector, the positive sample, and the negative sample to obtain the enhanced coupling sensitivity vector includes: The predicted vector, the features corresponding to the first positive sample and the first negative sample, and the features corresponding to the second positive sample and the second negative sample are input into the contrastive loss model for calculation and processing, so that the features corresponding to the predicted vector are clustered together in the latent feature space to obtain the enhanced coupling sensitive vector.

6. The method for anomaly detection in a small-sample cold source system based on graph neural networks according to claim 1, characterized in that, The step of calculating the abnormal sensitivity set based on the coupled sensitivity vector includes: Based on the coupling sensitivity vector and the dynamic coupling weights between nodes, the feature differences between each node and its neighboring nodes are calculated to obtain the local coupling sensitivity. Based on the Euclidean distance between the coupling sensitivity vector and the global feature center, the degree of deviation of each node relative to the overall system operating state is calculated to obtain the global coupling sensitivity. The univariate dynamic sensitivity is obtained by standardizing the deviation between the actual observed values ​​of the time series data and the predicted values ​​corresponding to the prediction vector, combined with a preset standard deviation.

7. The method for anomaly detection in a small-sample cold source system based on graph neural networks according to claim 1, characterized in that, The step of determining the target anomaly detection result based on the multi-scale coupled anomaly score includes: The temporal prediction error is obtained, and the multi-scale coupled anomaly score and the temporal prediction error are fused to obtain a comprehensive anomaly score; Adaptive threshold adjustment is performed based on the comprehensive anomaly score within the historical sliding window to determine the anomaly judgment threshold at the current moment. The comprehensive anomaly score is then compared with the anomaly judgment threshold to determine the anomaly level at the current moment based on the comparison result, and anomaly warning information is output.

8. A small-sample cold source system anomaly detection device based on graph neural networks, characterized in that, The device includes: The graph structure modeling module processes multi-source monitoring data from the cold source system to obtain standardized time-series data. It then constructs a graph structure based on the physical coupling relationships between various monitoring indicators in the time-series data. Finally, it uses a graph neural network to extract features from the graph structure to obtain node embedding features. The self-supervised contrastive learning module performs temporal modeling on the node embedding features through a long short-term memory network to obtain a prediction vector. It also generates simulated positive and negative samples by performing self-supervised perturbation training on the graph structure. Based on the prediction vector, the positive samples, and the negative samples, it optimizes the latent feature space to obtain an enhanced coupling-sensitive vector. The anomaly detection and early warning module calculates an anomaly sensitivity set based on the coupled sensitivity vector, and performs weighted fusion processing on each anomaly sensitivity in the anomaly sensitivity set to obtain a multi-scale coupled anomaly score, so as to determine the target anomaly detection result based on the multi-scale coupled anomaly score. The anomaly sensitivity set includes: local coupling sensitivity, global coupling sensitivity, and univariate dynamic sensitivity.

9. A server, characterized in that, The method includes a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions that, when invoked and executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

Images