Abnormity detection method and device based on deep multi-ellipsoid support vector data description

Abstract

The invention provides an anomaly detection method based on deep multi-ellipsoid support vector data description, which can be applied to the technical field of artificial intelligence. The method comprises the following steps: acquiring a multi-channel time sequence signal generated by equipment to be detected in operation; inputting the multi-channel time sequence signal into a pre-trained deep multi-ellipsoid support vector data description model to obtain an abnormal score of the to-be-detected equipment at the current moment; and determining an anomaly detection result according to the anomaly score, wherein the depth multi-ellipsoid support vector data description model is configured to extract high-dimensional features of the multi-channel time sequence signals based on a depth feature extraction network, and the high-dimensional features are used for representing a coupling relationship between the multi-channel time sequence signals and the operation state of the to-be-detected equipment; and calculating the minimum value of the square of the mahalanobis distance from the high-dimensional feature to the plurality of hyper-ellipsoid regions as an abnormal score. The invention further provides an anomaly detection device based on depth multi-ellipsoid support vector data description.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, specifically to the field of unsupervised learning technology, and more specifically to an anomaly detection method, apparatus, electronic device, storage medium, and program product based on deep multi-ellipsoidal support vector data description. Background Technology

[0002] In real-time anomaly detection of high-speed rotating machinery such as gas turbines, existing methods based on deep support vector data description have significant limitations. These methods force the assumption that normal data follows a single convex set distribution in the feature space and are enclosed by a hypersphere or hyperellipsoid. However, due to the diversity of operating conditions and the complexity of flow fields, the actual distribution of multi-channel sensor signals is often non-convex and multimodal. A single geometry cannot tightly fit complex boundaries, resulting in a large number of "envelope gaps" between the model and the data. This makes it impossible to effectively identify early weak fault signals within these gaps, causing warning delays. Therefore, how to achieve high-precision fitting of complex data distributions has become an urgent problem to be solved to improve the timeliness and reliability of fault warnings. Summary of the Invention

[0003] In view of the above problems, this application provides anomaly detection methods, apparatus, electronic devices, storage media, and program products based on depth multi-ellipsoidal support vector data description that improve the detection sensitivity of early weak anomalies.

[0004] According to a first aspect of this application, an anomaly detection method based on deep multi-ellipsoidal support vector data description is provided, comprising: acquiring a multi-channel time-series signal generated by a device under test during operation, the multi-channel time-series signal representing the operating state of each spatial location of the device under test at the current moment; inputting the multi-channel time-series signal into a pre-trained deep multi-ellipsoidal support vector data description model to obtain an anomaly score of the device under test at the current moment; and determining an anomaly detection result based on the anomaly score; wherein the deep multi-ellipsoidal support vector data description model is configured to: extract high-dimensional features of the multi-channel time-series signal based on a deep feature extraction network, the high-dimensional features being used to characterize the coupling relationship between the multi-channel time-series signal and the operating state of the device under test; and calculating the minimum value of the squared Mahalanobis distance from the high-dimensional features to multiple hyperellipsoidal regions as the anomaly score.

[0005] According to an embodiment of this application, pre-training a depth multi-ellipsoidal support vector data description model includes: collecting multi-channel time-series signals of the device under various normal operating conditions as training data; constructing a target loss function, which measures the overall distribution compactness of the feature vectors obtained after mapping the training data through the depth feature extraction network within a normal data decision region composed of K hyperellipsoids, where K is an integer greater than 1; training the parameters of the depth feature extraction network and the normal data decision region based on the target loss function to obtain the depth multi-ellipsoidal support vector data description model; wherein the normal data decision region serves as the depth multi-ellipsoidal support vector data description model, the K hyperellipsoids share the same common center, and the K hyperellipsoids are defined by K independent precision matrices to define their shape and orientation.

[0006] According to an embodiment of this application, a deep multi-ellipsoidal support vector data description model is obtained by training the parameters of the deep feature extraction network and the normal data decision region based on the target loss function, including: extracting a feature vector set of the training data through the deep feature extraction network; updating the parameters of the normal data decision region based on the feature vector set; calculating the value of the target loss function based on the updated parameters of the normal data decision region; updating the parameters of the deep feature extraction network according to the value of the loss function; and repeating the above steps until a preset training termination condition is met to obtain a trained deep multi-ellipsoidal support vector data description model.

[0007] According to an embodiment of this application, the parameters of the normal data decision region include a common center and K precision matrices. Updating the parameters of the normal data decision region based on the feature vector set includes: updating the common center based on the feature vector set; dividing the feature vector set into K feature vector subsets according to the directional distribution of each feature vector relative to the common center; and calculating the precision matrices corresponding to the K feature vector subsets.

[0008] According to an embodiment of this application, dividing the feature vector set into K feature vector subsets based on the directional distribution of each feature vector relative to the common center includes: calculating the difference vector between each feature vector and the common center; normalizing each difference vector to obtain a directional vector set corresponding to the feature vector set, wherein the directional vector set represents the directional distribution of training data sample points relative to the common center; performing cluster analysis on the directional vector set, and dividing the feature vector set into K feature vector subsets based on the cluster analysis results.

[0009] According to an embodiment of this application, the step of calculating the value of the target loss function based on the parameters of the updated normal data decision region includes: for each feature vector in the feature vector subset, calculating the squared Mahalanobis distance from the feature vector to the common center based on the updated common center and the precision matrix corresponding to the feature vector subset; and performing a summation and averaging operation on the squared Mahalanobis distance to obtain the value of the target loss function.

[0010] According to an embodiment of this application, determining the anomaly detection result based on the anomaly score includes: comparing the anomaly score with an adaptive decision threshold; determining the anomaly detection result based on the comparison result; wherein the adaptive decision threshold is determined by the following steps: obtaining anomaly scores calculated after inputting all normal training data into a deep multi-ellipsoidal support vector data description model, forming a score set; determining a quantile threshold in the score set according to a preset false positive rate tolerance parameter, such that the proportion of samples in the score set exceeding the quantile threshold is less than the preset false positive rate tolerance parameter; and determining the quantile threshold as the adaptive decision threshold.

[0011] A second aspect of this application provides an anomaly detection device based on depth multi-ellipsoidal support vector data description, comprising: a time-series signal acquisition module for acquiring multi-channel time-series signals generated by a device under test during operation, wherein the multi-channel time-series signals characterize the operating state of each spatial location of the device under test at the current moment; an anomaly score determination module for inputting the multi-channel time-series signals into a pre-trained depth multi-ellipsoidal support vector data description model to obtain an anomaly score of the device under test at the current moment; and an anomaly detection result determination module for determining an anomaly detection result based on the anomaly score; wherein the depth multi-ellipsoidal support vector data description model is configured to: extract high-dimensional features of the multi-channel time-series signals based on a deep feature extraction network, wherein the high-dimensional features characterize the coupling relationship between the multi-channel time-series signals and the operating state of the device under test; and calculate the minimum value of the squared Mahalanobis distance from the high-dimensional features to multiple hyperellipsoidal regions as the anomaly score.

[0012] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0013] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0014] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0015] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1A This illustration schematically shows a process for constructing a concentric single ellipsoidal health baseline model according to an embodiment of this application.

[0017] Figure 1B This illustration schematically shows a process for constructing a concentric multi-ellipsoidal health baseline model according to an embodiment of this application.

[0018] Figure 2 The flowchart illustrates a method for constructing a depth multi-ellipsoidal support vector data description model according to an embodiment of this application.

[0019] Figure 3A This illustration shows one of the schematic diagrams of data preprocessing results provided according to an embodiment of this application;

[0020] Figure 3B This illustration shows a second schematic diagram of the data preprocessing results provided according to an embodiment of this application;

[0021] Figure 3C This illustration shows a third schematic diagram of the data preprocessing results provided according to an embodiment of this application;

[0022] Figure 3D This illustration shows a fourth schematic diagram of the data preprocessing results provided according to an embodiment of this application;

[0023] Figure 4 The flowchart illustrates another method for constructing a depth multi-ellipsoidal support vector data description model according to an embodiment of this application.

[0024] Figure 5 A flowchart illustrating an anomaly detection method based on depth multi-ellipsoidal support vector data description provided in an embodiment of this application is shown schematically.

[0025] Figure 6 This illustration schematically shows a comparison of abnormal health baseline scores between concentric single ellipsoids and multi-ellipsoids according to embodiments of this application.

[0026] Figure 7 This schematically illustrates a structural block diagram of an anomaly detection device based on depth multi-ellipsoidal support vector data description according to an embodiment of this application; and

[0027] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly detection method based on depth multi-ellipsoidal support vector data description, according to an embodiment of this application. Detailed Implementation

[0028] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0032] Gas turbines and aero engines, as core equipment for aviation propulsion and industrial drive, are crucial for operational stability. Their compressor components, in particular, often operate under high loads and high efficiency ranges, approaching aerodynamic stability boundaries. Under these extreme conditions, minute disturbances in the flow field are easily amplified nonlinearly, inducing catastrophic aerodynamic instability phenomena such as rotating stall and surge. Accurate identification and early warning at the initial, subtle signs of a failure would buy valuable time for proactive intervention and safe handling, thereby preventing significant structural damage and economic losses.

[0033] Currently, data-driven anomaly detection technology is the mainstream approach for online health monitoring. These methods typically rely on multi-channel time-series signals collected by sensor arrays (such as dynamic pressure sensors and vibration sensors) installed in critical parts of the equipment. Anomaly detection is achieved by constructing a "health baseline" model under normal operating conditions and calculating the deviation of current data from this baseline in real time.

[0034] Support Vector Data Description (SVDD) and its variants are classic uniclass classification methods, widely used in anomaly detection scenarios because they only require training on normal samples. Traditional SVDD and its deep extensions (such as Deep SVDD) aim to find a minimal hypersphere or a single hyperellipsoid in a high-dimensional feature space that encloses all or most normal data points. The distance from the test sample to the center of this sphere or ellipsoid is used as an anomaly score; the greater the distance, the higher the probability of an anomaly.

[0035] However, in actual industrial scenarios, especially in complex systems such as gas turbine compressors, the distribution of normal operating data collected by multiple sensors in high-dimensional feature space often presents a non-convex, multimodal complex topological structure, rather than a simple single spherical or ellipsoidal cluster. This is mainly due to: (1) the equipment operation covers a variety of steady-state conditions (such as different speeds and loads), and the data under each condition will form an independent clustering pattern; (2) the spatial coupling relationship between multi-channel signals is complex, resulting in an irregular data distribution pattern. When a single, regular geometric shape (such as a sphere or ellipsoid) is used to wrap this irregularly shaped complex data distribution, a large number of "invalid gaps" or "envelope blind zones" will inevitably be generated between the real data boundary and the model boundary. Data points in these blind zones, even if they are edge cases of normal state or early signs of weak faults, will be misjudged as normal because they are included within the model boundary. This makes the existing anomaly detection methods based on single-center geometric models extremely insensitive to initial and weak fault precursors, with serious early warning lag, greatly compressing the response window for safe operation.

[0036] In addition, existing methods usually rely heavily on preset, fixed anomaly detection thresholds, making it difficult to adapt to fluctuations in different operating conditions and the natural degradation of equipment performance, which further affects the reliability and generalization ability of the early warning system.

[0037] Therefore, there is an urgent need for an anomaly detection method that can overcome the limitations of a single geometric center and adaptively match the real topology of complex data. This method needs to be able to automatically learn and construct a more refined "health baseline" model that better fits the distribution of real data from multi-channel time-series data to eliminate invalid envelope gaps, thereby achieving highly sensitive, real-time monitoring of weak anomaly precursors without blind spots, and possessing adaptive decision-making capabilities.

[0038] In view of the above-mentioned technical problems, embodiments of this application provide an anomaly detection method based on deep multi-ellipsoidal support vector data description, comprising: acquiring multi-channel time-series signals generated by a device under test during operation, wherein the multi-channel time-series signals characterize the operating state of each spatial location of the device under test at the current moment; inputting the multi-channel time-series signals into a pre-trained deep multi-ellipsoidal support vector data description model to obtain an anomaly score of the device under test at the current moment; and determining an anomaly detection result based on the anomaly score; wherein the deep multi-ellipsoidal support vector data description model is configured to: extract high-dimensional features of the multi-channel time-series signals based on a deep feature extraction network, wherein the high-dimensional features are used to characterize the coupling relationship between the multi-channel time-series signals and the operating state of the device under test; and calculate the minimum value of the squared Mahalanobis distance from the high-dimensional features to multiple hyperellipsoidal regions as the anomaly score.

[0039] By introducing a "deep feature extraction network," the original multi-channel time-series signals are mapped into high-dimensional features representing their deep coupling relationships. A composite decision region composed of "multiple shared-center hyperellipsoids" is constructed, enabling the model to accurately fit the complex, non-convex true distribution of normal data in the feature space. This eliminates the invalid gaps (detection blind spots) between the boundaries of traditional single geometric models and the data distribution. Furthermore, by calculating the "minimum of the squared Mahalanobis distance" from the test sample to this composite region as a unified and adaptive anomaly score, even slight deviations located at the edge of any local ellipsoid can be sensitively captured. Ultimately, this achieves highly sensitive and accurate real-time early warning of early-stage minor equipment faults and enhances the adaptability to changing operating conditions.

[0040] Figure 1A The illustration shows a schematic diagram of the process for constructing a concentric single ellipsoidal health baseline model according to an embodiment of this application.

[0041] like Figure 1A The diagram illustrates the detailed process for constructing a concentric single-ellipsoidal health baseline model (i.e., the basic single-ellipsoidal SVDD model) provided in this application embodiment, serving as a benchmark for comparison with multi-ellipsoidal models. The X-space represents the original input space, showing a set of scattered data points representing the raw time-series signal data collected from multiple sensors, with an irregular distribution. Deep neural network. The deep feature extraction network maps raw data to a high-dimensional feature space through multi-layer nonlinear transformations (weights W1 to Wn). The F-space represents the mapped high-dimensional feature space, where data points are more compactly distributed and form a single hyperellipsoidal boundary (shown as a dashed ellipse), with c as the ellipsoidal center. This ellipsoid encloses the normal data, achieving a compact description of the normal data distribution. First, multi-sensor time-series signals undergo data preprocessing, including signal slicing, temporal feature extraction, and normalization, constructing training and testing sets. Then, the training set is input into the deep neural network for feature extraction, obtaining a high-dimensional feature representation. Next, the mean of the feature vectors is calculated as the hyperellipsoidal center, and the accuracy matrix is ​​calculated based on the feature distribution to determine the ellipsoid's shape and orientation, constructing a single hyperellipsoidal health baseline. Finally, by optimizing network and ellipsoidal parameters, the normal data is compactly distributed within the ellipsoidal boundary in the feature space, achieving an effective characterization of the equipment's health status under a single operating condition.

[0042] Figure 1B The illustration shows a schematic diagram of the process for constructing a concentric multi-ellipsoidal health baseline model according to an embodiment of this application.

[0043] like Figure 1B As shown, in Figure 1A Based on the concentric single ellipsoidal health baseline model shown, the construction process of the concentric multi-ellipsoidal health baseline model is as follows: First, multi-channel sensor time-series signals of the gas turbine under various normal operating conditions are collected. After preprocessing steps such as sliding time window slicing, time-domain feature extraction, and data normalization, a training dataset covering multiple operating conditions is constructed. Then, the training data is input into a deep neural network for high-dimensional feature mapping. The deep structure and spatiotemporal coupling features of the data are extracted through nonlinear transformation of the network. Based on this, the mean vector of all feature vectors is calculated as the unique common center shared by multiple hyperellipsoids, and the direction vector of each feature vector relative to this center is calculated to construct a square vector representing the angular distribution of the data. The system first sets directional vectors; then, it uses a clustering algorithm to group the directional vectors, dividing the feature data into multiple subsets that are highly clustered in direction. Each subset corresponds to a typical normal operating condition or data distribution pattern. For each feature subset, the distribution characteristics are calculated independently, and the corresponding accuracy matrix is ​​solved to determine the unique shape and orientation of each hyperellipsoid. Multiple hyperellipsoids that are adaptive to the local data structure are constructed. Finally, these hyperellipsoids are merged into a composite, non-convex normal data decision region, forming a concentric heterogeneous health baseline that can tightly wrap the multimodal data distribution. Through end-to-end training, the network parameters and multi-ellipsoid structure are optimized, enabling the model to have a high-precision ability to identify abnormal precursors under complex operating conditions.

[0044] Figure 2 The flowchart illustrates a method for constructing a depth multi-ellipsoidal support vector data description model according to an embodiment of this application. Figure 3AOne of the schematic diagrams of data preprocessing results provided according to an embodiment of this application is illustrated. Figure 3B The illustration shows a second schematic diagram of the data preprocessing results provided according to an embodiment of this application. Figure 3C The diagram illustrates the third schematic representation of the data preprocessing results provided according to an embodiment of this application. Figure 3D The illustration shows the fourth schematic diagram of the data preprocessing results provided according to the embodiments of this application.

[0045] like Figure 2 As shown, this includes operations S210 to S230.

[0046] During operation of S210, multi-channel timing signals of the device under test under various normal operating conditions are collected as training data.

[0047] In one example, multi-channel time-series signals from dynamic pressure sensors across different stages of the compressor are acquired under various stable operating conditions (e.g., different speeds) of the gas turbine. A sliding time window (e.g., window length of 1024 sampling points, overlap rate of 50%) is used to segment the continuous signal. For each data segment within the window, five time-domain statistical features—maximum, minimum, average, variance, and standard deviation—are extracted to form a feature vector. All feature vectors are normalized to the [0,1] interval to form the training dataset. , where N is the total number of samples.

[0048] Figure 3A This diagram illustrates the time-domain waveform of the compressor's dynamic pressure signal and its frequency-domain characteristics under different operating conditions. It includes four sub-figures describing the signal evolution from normal operation to stall failure. Figure 3A As shown in the figure, this diagram fully presents the dynamic evolution of the compressor from normal operation → transition state → stall failure:

[0049] The first image (time domain signal) shows the time domain waveform of a continuous dynamic pressure signal for approximately 160 seconds. The signal amplitude is small and stable for the first 150 seconds, representing normal operation; after about 150 seconds, the signal amplitude increases sharply and fluctuates violently, indicating the occurrence of a stall failure.

[0050] The second image (normal state spectrum): FFT analysis was performed on the normal operation period (approximately 0-150 seconds). The spectral energy is mainly concentrated in the low-frequency region, with a low overall amplitude, flat distribution, and no obvious prominent frequency components, which characterizes the stable and healthy state of the flow field.

[0051] The third spectrum (intermediate state spectrum): In the pre-stall stage, the spectrum changes significantly, with an energy accumulation peak appearing around 15Hz and a significant increase in amplitude. At the same time, the energy in the low-frequency band increases, reflecting the beginning of local disturbances and periodic pressure pulsations in the flow field, which is an early warning signal of stall.

[0052] The fourth image (stall state spectrum): After stall occurs, the spectrum changes drastically, with an extremely strong dominant frequency peak (amplitude close to 10,000) appearing at about 13-14 Hz, and an overtone component appearing at about 29 Hz. The energy in the low frequency band is greatly enhanced, exhibiting typical rotating stall characteristic frequencies, indicating that the flow field has become severely unstable.

[0053] Figure 3A This study visually verified the sensitivity of frequency domain characteristics to compressor stall faults, showing that the signal spectrum exhibits significant differences at different stages of stall development: the spectrum is flat in the normal state, precursor frequency peaks appear in the intermediate state, and strong characteristic frequencies appear in the stall state. This provides a theoretical basis for anomaly detection methods based on frequency domain characteristics and also illustrates the need to identify anomalies in a timely manner during the stall precursor period (intermediate state) to prevent them from developing into severe stall faults.

[0054] Figure 3B This illustrates the transformation process from the original time-domain signal to a time-domain feature sequence, comprising two sub-figures that compare the evolution trends of the original signal and the signal after extracting the average value features. Figure 3B As shown, the upper subplot (original signal) displays the time-domain waveform of the original dynamic pressure signal for approximately 160 seconds. The sampling frequency is high, and the signal exhibits dense random fluctuations. For the first 150 seconds, the signal is generally stable, with amplitude fluctuating around 0.2-0.3. After approximately 150 seconds, the signal amplitude drops sharply and is accompanied by violent oscillations, indicating the occurrence of a stall failure. Due to the high sampling rate and large data volume, direct analysis makes it difficult to observe long-term trends. The lower subplot (average value characteristics) uses a sliding time window to segment the original signal, extracting the average value within each window to form a downsampled feature sequence. The horizontal axis represents the window number (approximately 0-16000), corresponding to the time progression of the original signal. This figure clearly shows the gradual change trend of the signal's average value: initially stable around 0.20, then slowly rising to approximately 0.25 before the failure, and then plummeting below 0.15 after the stall. This trend-like change better reflects the slow deterioration process of the equipment's condition than the random fluctuations of the original signal.

[0055] Figure 3B The effectiveness of the sliding window time-domain feature extraction was verified. By extracting statistical features such as the average value, data dimensionality reduction was achieved, reducing the computational burden on subsequent models. Furthermore, high-frequency random noise interference was eliminated, highlighting long-term signal trends and enabling the detection of early, subtle state drift and precursory faults. The gradual increase in the average value indicates that abnormal signs appeared in the system before stalling, providing observable indicators for early warning.

[0056] Figure 3CThis diagram illustrates the maximum value feature variation process of the compressor dynamic pressure signal after time-domain feature extraction, comprising two sub-graphs comparing the evolution trends of the original signal and the signal after maximum value feature extraction. Figure 3C The diagram illustrates the transformation process from the original time-domain signal to a maximum value feature sequence and its sensitivity to fault precursors.

[0057] The upper subplot (raw signal) shows the time-domain waveform of the raw dynamic pressure signal for approximately 160 seconds. The sampling frequency is high, and the signal exhibits dense random fluctuations. For the first 150 seconds, the signal amplitude is relatively stable, remaining within the 0.2-0.4 range. After approximately 150 seconds, the signal amplitude undergoes a drastic change, shifting horizontally downwards and accompanied by large oscillations, indicating the occurrence of a stall failure.

[0058] The subplot (maximum value feature): The original signal is segmented using a sliding time window, and the maximum value of the signal within each window is extracted to form a feature sequence. The horizontal axis represents the window number (approximately 0-16000). Unlike the average value feature, the maximum value feature exhibits significant fluctuations, gradually increasing from an initial value of approximately 0.28 to the 0.32-0.34 range. Multiple spikes (amplitudes exceeding 0.38) occur before the fault, followed by a sharp drop to lower levels after the stall. This fluctuation characteristic can capture extreme events and instantaneous impacts in the signal, reflecting occasional pressure pulsations and local disturbances in the flow field. Figure 3C This demonstrates the unique value of maximum value features in anomaly detection. As an extreme statistic, the maximum value is highly sensitive to sudden spikes and anomalous shocks in signals, capable of capturing instantaneous anomalies that are difficult to reflect with average value features. The multiple spikes preceding the fault in the figure indicate that the system experienced intermittent pressure surges before stalling; these early, weak disturbances are important precursors to flow field instability. By fusing multi-dimensional time-domain features such as maximum and average values, the central trend and extreme fluctuation characteristics of the signal can be comprehensively characterized, providing richer information input for constructing a highly sensitive health baseline model.

[0059] Figure 3D This diagram illustrates the variance characteristic change process of the compressor dynamic pressure signal after time-domain feature extraction, comprising two sub-graphs comparing the evolution trends of the original signal and the signal after variance feature extraction. Figure 3D As shown, this illustrates the transformation process from the original time-domain signal to a variance feature sequence and its ability to characterize signal fluctuations:

[0060] The upper sub-plot (original signal) shows the time-domain waveform of the original dynamic pressure signal for about 160 seconds. Although the signal fluctuates randomly in the first 150 seconds, the overall amplitude is relatively stable. After about 150 seconds, the signal undergoes a violent change, with the fluctuation amplitude increasing significantly and accompanied by large oscillations, indicating the occurrence of stall failure.

[0061] The subplot below (variance features): The original signal is segmented using a sliding time window, and the variance of the signal within each window is extracted to form a feature sequence. The horizontal axis represents the window number (approximately 0-16000). Compared to the mean and maximum features, the variance features exhibit a distinctly different pattern of change: during normal operation (approximately 0-15000 sample points), the variance value is extremely low and almost zero (close to 0.0005), indicating stable signal fluctuations and uniform energy distribution; however, after a stall failure occurs (after 15000 sample points), the variance value jumps sharply to over 0.0125, an increase of tens of times. This abrupt change makes variance a strong indicative indicator of stall occurrence.

[0062] Variance, as a measure of volatility, effectively characterizes the dispersion of signal energy. During normal operation, the flow field is stable, pressure pulsations are weak, and variance remains low. When stall occurs, the flow field is violently disturbed, the pressure signal exhibits strong non-stationarity and large fluctuations, and variance increases sharply. This characteristic makes variance features highly discriminative of fault states, making them particularly suitable as key input features for anomaly detection. Furthermore, the extremely low variance values ​​before a fault provide a stable benchmark for early warning; once the variance exceeds a threshold, an alarm is triggered.

[0063] In operation S220, construct the target loss function.

[0064] According to an embodiment of this application, the target loss function is used to measure the overall distribution compactness of the feature vector obtained after the training data is mapped by the deep feature extraction network within a normal data decision region composed of K hyperellipsoids, where K is an integer greater than 1.

[0065] In one example, the core objective of this model is defined as follows: through learning, all normal training samples are compactly distributed in the high-dimensional feature space mapped by the deep network within the normal data decision region defined by a common center and K hyperellipsoids (K>1). The target loss function is constructed as shown in Equation (1):

[0066] (1)

[0067] in, Characterization Samples The mapped d-dimensional high-dimensional feature vector The parameter is A deep feature extraction network, which acts as a feature extractor, extracts the raw input data. Perform a nonlinear mapping to transform it into a new high-dimensional feature space. The aim is to automatically extract and separate the inherent structure and common features of data through network learning, creating conditions for subsequently building compact data boundaries.

[0068] The common geometric center shared by all K hyperellipsoids. It is the precision matrix (i.e., the inverse of the covariance matrix) of the k-th hyperellipsoid, used to define the shape and orientation of the ellipsoid. The K precision matrices are independent of each other. That is, eigenvectors To Centered on, with Let be the squared Mahalanobis distance of the k-th hyperellipsoid of the precision matrix. The operation means that for each sample, the value with the smallest distance to the K hyperellipsoids is selected as its contribution to the loss. That is, as long as a sample is close enough to any one of the hyperellipsoids, its loss will be small.

[0069] The physical meaning of this loss function lies in measuring the average of the squared Mahalanobis distances from the feature vectors of all training samples to their nearest hyperellipsoids. Minimizing this loss drives the network to learn a feature representation and simultaneously optimizes the ellipsoid parameters so that all normal samples fall as "compactly" as possible into the normal data decision region formed by these K hyperellipsoids.

[0070] In operation S230, the parameters of the deep feature extraction network and the normal data decision region are trained based on the target loss function to obtain a deep multi-ellipsoid support vector data description model.

[0071] According to an embodiment of this application, the normal data decision region serves as the depth multi-ellipsoid support vector data description model, the K hyperellipsoids share the same common center, and the K hyperellipsoids are defined by K independent precision matrices to define their shape and orientation.

[0072] In one example, after obtaining training data and constructing the target loss function, the model enters its core training phase. The training objective of this embodiment is to jointly optimize the parameters of the deep feature extraction network. Structural parameters (center of ellipsoid) of the normal data decision region Precision matrix This allows the two to adapt to each other, ultimately resulting in a composite model that tightly encapsulates the complex distribution of normal data, namely, the deep multi-ellipsoidal support vector data description model. The parameter W refers to all learnable weights in the feature extraction network Stall_Net, which constitutes the nonlinear transformation operator that maps the raw sensor data (such as pressure signal cloud maps) to a high-dimensional feature space. For example, it can include:

[0073] 1) Convolutional layer parameters: including the weight matrices of the first convolutional layer (conv1, 8 5×5 convolutional kernels) and the second convolutional layer (conv2, 4 5×5 convolutional kernels), used to extract local spatial features and correlations in the original signal.

[0074] 2) Batch normalization layer parameters: including scaling factor (Weight) and bias factor (Bias), used to ensure the stability of feature distribution during training.

[0075] 3) Fully connected layer parameters: These refer to the weight matrix (32 dimensions: fc1_input_dims) of the final linear layer, responsible for compressing and mapping the pooled multi-channel feature vectors into the final 32-dimensional high-dimensional feature vectors. These parameters W collectively determine the distribution of the point cloud in the feature space and are the basis for constructing the subsequent Mahalanobis distance boundary. The training process adopts an iterative optimization approach; for specific technical solutions and principles, please refer to operations S310~S340, which will not be elaborated here.

[0076] After training, the model can be used for anomaly detection. Data outside the training set is used as the test set. The network calculates its feature representation and the squared Mahalanobis distance to the center c; this distance is the final anomaly score. Based on the prediction results and the ground truth labels, the model's AUC metric is calculated to evaluate its anomaly detection capability.

[0077] Figure 4 The flowchart illustrates another method for constructing a depth multi-ellipsoidal support vector data description model according to an embodiment of this application.

[0078] like Figure 4 As shown, this includes operations S310 to S340.

[0079] In operation S310, the feature vector set of the training data is extracted through the deep feature extraction network.

[0080] In one example, the weights of the deep feature extraction network are randomly initialized or initialized using pre-trained weights. Simultaneously, the parameters of the normal data decision region are initialized, including: setting the number of hyperellipsoids K (K>1), initializing a common center vector (e.g., initialized as a zero vector or the feature mean of the first batch of data), and initializing a precision matrix for each hyperellipsoid (e.g., initialized as an identity matrix).

[0081] In operation S320, the parameters of the normal data decision region are updated based on the feature vector set.

[0082] According to an embodiment of this application, the parameters of the normal data decision region include a common center and K precision matrices. Updating the parameters of the normal data decision region based on the feature vector set includes: updating the common center based on the feature vector set; dividing the feature vector set into K feature vector subsets according to the directional distribution of each feature vector relative to the common center; and calculating the precision matrices corresponding to the K feature vector subsets.

[0083] In one example, in each training iteration, the following sub-steps are performed: The current batch of training data is input into a deep feature extraction network, and the original data is mapped into high-dimensional feature vectors through the network's forward propagation. Based on the feature vectors of the current batch of data, the parameters of the normal data decision region are updated to better fit the distribution of the current data. The mean of all feature vectors in the current batch is calculated, and the position of the global common center is smoothly updated using methods such as moving average. Data clusters are partitioned, and the precision matrix is ​​calculated. Specifically, the common center is first initialized, for example, by extracting the feature vector set of the training data through the deep feature extraction network. , d represents the dimension of the feature space. To construct a concentric multi-ellipsoid model, the set of feature vectors is first calculated. The mean vector of is used as the unique common center c shared by all hyperellipsoids:

[0084] (2)

[0085] After determining the common center, the feature vector set is divided into K feature vector subsets according to the directional distribution of each feature vector relative to the common center.

[0086] According to an embodiment of this application, dividing the feature vector set into K feature vector subsets based on the directional distribution of each feature vector relative to the common center includes: calculating the difference vector between each feature vector and the common center; normalizing each difference vector to obtain a directional vector set corresponding to the feature vector set, wherein the directional vector set represents the directional distribution of training data sample points relative to the common center; performing cluster analysis on the directional vector set, and dividing the feature vector set into K feature vector subsets based on the cluster analysis results.

[0087] In one example, the orientation of each feature vector relative to the current common center is calculated (i.e., centered and normalized to obtain the orientation vector). Then, these orientation vectors are clustered using a clustering algorithm (e.g., K-Means). Based on the clustering results, all training samples in the current batch are divided into K distinct clusters, where samples within each cluster have a similar orientation distribution in the feature space. For each data cluster obtained from the above steps, the distribution characteristics of its internal feature vectors are independently calculated. The covariance matrix of the cluster is calculated, and this covariance matrix is ​​inverted and regularized to obtain an independent precision matrix defining the shape and orientation of the hyperellipsoid corresponding to the cluster. This process ensures that although the K hyperellipsoids share a center, each has a unique shape to accommodate data distributions in different directions.

[0088] Specifically, based on the initialized common center c, for each feature vector in the feature vector set Z... Calculate the difference vector of each feature vector with respect to the common center c. Subsequently, for each non-zero difference vector... Normalization is performed to obtain the unit direction vector. All direction vectors form a set. This set represents the directional distribution of all training data sample points relative to a common center. (The set of direction vectors is also mentioned.) Cluster analysis can be performed, for example, using the K-Means clustering algorithm to analyze the set of direction vectors. Cluster analysis is performed, with the number of clusters set to a preset number of hyperellipsoids, K. This clustering process divides all data samples into K mutually exclusive categories. Each category... (Where k=1,...,K) represents a highly clustered data pattern in a direction. For each subset of data... Corresponding feature vector subset Calculate the subset independently. covariance matrix By inverting the covariance matrix, the accuracy matrix of the k-th hyperellipsoid is obtained. See formula (3):

[0089] (3)

[0090] in, It is a very small positive real number used to ensure that the matrix is ​​non-singular.

[0091] In operation S330, the value of the target loss function is calculated based on the parameters of the updated normal data decision region.

[0092] According to an embodiment of this application, the step of calculating the value of the target loss function based on the parameters of the updated normal data decision region includes: for each feature vector in the feature vector subset, calculating the squared Mahalanobis distance from the feature vector to the common center based on the updated common center and the precision matrix corresponding to the feature vector subset; and performing a summation and averaging operation on the squared Mahalanobis distance to obtain the value of the target loss function.

[0093] In operation S340, the parameters of the deep feature extraction network are updated according to the value of the loss function.

[0094] Repeat the above steps until the preset training termination condition is met to obtain the trained depth multi-ellipsoidal support vector data description model.

[0095] In one example, using the updated common center and K precision matrices, the overall loss value of the current batch of data under the existing model is calculated according to a pre-constructed target loss function (the core of which is to calculate the squared Mahalanobis distance from each sample to its nearest hyperellipsoid). This loss value reflects the compactness of the distribution of normal data within the decision region composed of K hyperellipsoids. The calculated loss value is backpropagated to calculate the gradient of the loss with respect to the parameters of the deep feature extraction network. The weight parameters of the network are updated using a gradient descent algorithm or a variant thereof. This aims to adjust the feature extraction network so that it can map the data to a new feature representation space in which normal data can be described with greater compactness by the multi-ellipsoidal decision region. The above iterative training loop is repeated until a preset number of training epochs or the loss function converges. After training, the final model components are output, including: an optimized deep feature extraction network, a stable common geometric center, and K independent precision matrices. These components together constitute the "Deep Multi-Ellipsoid Support Vector Data Description Model" protected in this application. The logical union of K hyperellipsoids that share a common focus and are defined by their respective precision matrices constitutes the normal data decision region learned by the model.

[0096] Through the training process described in this embodiment, the model achieves end-to-end collaborative optimization of deep feature learning and complex decision boundary modeling. The final model can more precisely characterize the multimodal and non-convex distributions that normal data may exist in the high-dimensional feature space, thus laying the foundation for subsequent high-sensitivity anomaly detection.

[0097] By constructing a joint loss function centered on the minimum squared Mahalanobis distance and employing an end-to-end collaborative optimization mechanism, the parameters of the deep feature extraction network and the multi-ellipsoidal decision region are trained simultaneously. This process achieves a bidirectional adaptation between deep feature learning and complex boundary modeling: the deep network learns to extract features that make normal data more easily described by multiple ellipsoids in the feature space; the center and morphological parameters of the multiple ellipsoids, guided by the network features, adaptively match the true multimodal and non-convex distribution of the data. This joint training overcomes the shortcomings of traditional step-by-step training or models with fixed features that struggle to closely fit complex data distributions, resulting in a more refined and compact boundary for the final healthy baseline model. This lays a crucial foundation for high-sensitivity anomaly detection and significantly improves the model's generalization ability to varying normal operating conditions.

[0098] Figure 5 A flowchart illustrating an anomaly detection method based on depth multi-ellipsoidal support vector data description provided according to an embodiment of this application is shown. Figure 5 As shown, this includes operations S510 to S530.

[0099] In operation S510, multi-channel timing signals generated by the device under test during operation are acquired. According to an embodiment of this application, the multi-channel timing signals characterize the operating state of each spatial position of the device under test at the current moment.

[0100] In one example, this step aims to collect and prepare input data for real-time evaluation. Taking a gas turbine under test as an example, the system synchronously collects time-series signals near the current moment from multiple dynamic pressure sensors deployed across various stages of the compressor (such as the inlet, outlet, and several intermediate stages). These signals constitute a multi-channel time series, with each channel continuously reflecting the aerodynamic pressure state at the corresponding spatial location. The system employs the same preprocessing logic as in the model training phase: First, a sliding window is used to truncate the latest continuous signal to obtain a short time series segment of the same length as the training samples; then, the same time-domain feature extraction (such as calculating the maximum, minimum, mean, variance, and standard deviation) is performed on this data segment to generate a feature vector reflecting the current short-term operating state; finally, the same normalization process is applied to this feature vector to obtain standardized samples that can be directly input into the model. This standardized sample is a mathematical abstraction representing the multi-channel timing information of the device's various spatial locations at the current moment.

[0101] In operation S520, the multi-channel time-series signal is input into a pre-trained depth multi-ellipsoidal support vector data description model to obtain the anomaly score of the device under test at the current moment.

[0102] According to an embodiment of this application, the deep multi-ellipsoidal support vector data description model is configured to: extract high-dimensional features of the multi-channel time-series signal based on a deep feature extraction network, wherein the high-dimensional features are used to characterize the coupling relationship between the multi-channel time-series signal and the operating state of the device under test; and calculate the minimum value of the squared Mahalanobis distance from the high-dimensional features to multiple hyperellipsoidal regions as the anomaly score.

[0103] In one example, the above standardized sample The trained deep feature extraction network is input into the network. Based on the parameters learned during training, the network performs nonlinear transformations and high-level abstractions on the input data, outputting a high-dimensional feature vector. This feature vector is not a simple accumulation of statistics, but a compact mathematical expression that the network automatically learns, capable of representing the complex spatiotemporal coupling relationship between multi-channel signals and its correlation with the overall health status of the device.

[0104] The model loads pre-trained decision region parameters, including the common geometric center. and K independent precision matrices Calculate high-dimensional eigenvectors Squared Mahalanobis distance relative to each learned hyperellipsoid :

[0105] (4)

[0106] Get K distance values Each squared Mahalanobis distance quantifies the degree of deviation of the test state from the corresponding normal cluster in a specific direction or pattern. The minimum value among these K distance values ​​is selected as the final anomaly score S for the test sample. The minimum distance principle reflects the essence of the model's decision region as the union of multiple hyperellipsoids, meaning that as long as the current state is sufficiently close to any normal operating condition pattern, it is considered to be within the normal range. Therefore, the smaller the S value, the closer the current state is to a known normal pattern; the larger the S value, the more the current state deviates from all normal patterns, and the higher the probability of an anomaly.

[0107] In operation S530, the anomaly detection result is determined based on the anomaly score.

[0108] According to an embodiment of this application, determining the anomaly detection result based on the anomaly score includes: comparing the anomaly score with an adaptive decision threshold; determining the anomaly detection result based on the comparison result; wherein the adaptive decision threshold is determined by the following steps: obtaining anomaly scores calculated after inputting all normal training data into a deep multi-ellipsoidal support vector data description model, forming a score set; determining a quantile threshold in the score set according to a preset false positive rate tolerance parameter, such that the proportion of samples in the score set exceeding the quantile threshold is less than the preset false positive rate tolerance parameter; and determining the quantile threshold as the adaptive decision threshold.

[0109] In one example, the final outlier score S is compared with a decision threshold R (i.e., an adaptive decision threshold) determined based on a preset quantile. This preset quantile is determined by the upper bound of the proportion of outliers in the normal training data that the model can tolerate, which is determined by the model hyperparameter ν (i.e., the preset false positive rate tolerance parameter), as shown in Equation (5):

[0110] (5)

[0111] in, To take the supremum, let represent the sum of all real numbers that satisfy the condition (within the curly braces). In the middle, take the smallest number as . For candidate thresholds, Let be the empirical distribution function. The anomaly score is calculated for the i-th normal training sample using a pre-trained deep multi-ellipsoidal support vector data description model. For indicator functions. When When the anomaly score is less than or equal to the candidate threshold, the value is 1; otherwise, it is zero. This score is calculated based on the anomaly score among all normal training samples that is less than or equal to the candidate threshold. The proportion of samples that are considered normal. It reflects how many normal samples will be correctly identified as normal by the model when the threshold is set to s. The preset false positive rate tolerance parameter is set by the user before model deployment. It represents the minimum proportion of normal samples that the model can cover. For example, if... A value of 0.01 indicates that the threshold R must cover at least 99% of the normal samples. If... If the sample does not meet the criteria, it is considered abnormal; otherwise, it is considered normal.

[0112] The core physical meaning of formula (5) is to automatically and objectively determine an optimal anomaly detection threshold based on the statistical distribution of the normal training data itself and the user's tolerance for false positives. This formula reflects the "normal state" boundary (represented by S) learned during the model training phase. iBy combining the distribution of the anomaly with the user-defined reliability requirements (ν), a reasonable, self-consistent, and interpretable adaptive decision threshold R is automatically generated. This is the key technical aspect of achieving adaptability and high reliability in the anomaly detection method of this application.

[0113] By employing a pre-trained deep multi-ellipsoidal support vector data description model, and executing a detection process based on deep feature extraction and minimum Mahalanobis distance squared scoring, highly sensitive and adaptive real-time early warning of early, subtle faults in complex industrial equipment is achieved. The deep feature extraction network in the model automatically learns and extracts spatiotemporal correlation features deeply coupled with the equipment's health status from multi-channel time-series signals, replacing the limitations of manually defined features and establishing anomaly scoring based on a more physically relevant state representation. The model utilizes multiple hyperellipsoids sharing a common center but with independent shapes to jointly construct the decision region. This structure can accurately fit the multimodal, non-convex, complex distribution that normal data may exhibit in a high-dimensional feature space, eliminating the "envelope gaps" or "detection blind spots" caused by the singular geometric shape of traditional single-sphere or single-ellipsoidal models. Finally, by calculating the minimum Mahalanobis distance from the feature to be tested to this composite region as a unified anomaly score, it ensures that any deviation from any local normal pattern in the current state can be sensitively detected. This allows the method provided in this application to identify subtle precursors to deviations from normal operating conditions earlier and more accurately, improving the reliability of anomaly detection and the advance warning time.

[0114] Figure 6 The illustration shows a comparison of abnormal baseline scores for health baselines between concentric single ellipsoids and multi-ellipsoids according to embodiments of this application.

[0115] like Figure 6 The figure shows the experimental results of a time-series comparison between the anomaly detection method provided in this application and traditional methods. The horizontal axis represents time (seconds), and the vertical axis represents the values ​​of different data sequences. The figure contains three key curves: the original data, serving as a background reference; the single-ellipsoidal SVDD anomaly score, representing the detection result of the traditional method; and the multi-ellipsoidal SVDD anomaly score, representing the detection result of the method provided in this application. The comparison shows that, under the same original data input, the anomaly score based on multi-ellipsoidal SVDD exhibits an earlier and more significant upward trend in the fault precursor stage compared to the traditional method (single-ellipsoidal SVDD), and the baseline is more stable. This result intuitively verifies that this application, through its multi-ellipsoidal structure, can more sensitively capture early weak anomaly signals, effectively improving the early warning lead time.

[0116] Based on the above-mentioned anomaly detection method based on depth multi-ellipsoid support vector data description, this application also provides an anomaly detection device based on depth multi-ellipsoid support vector data description. The following will be combined with... Figure 7 The device is described in detail.

[0117] Figure 7 The diagram illustrates the structure of an anomaly detection device based on depth multi-ellipsoidal support vector data description according to an embodiment of this application.

[0118] like Figure 7 As shown, the anomaly detection device 700 based on depth multi-ellipsoid support vector data description in this embodiment includes a time-series signal acquisition module 710, an anomaly scoring determination module 720, and an anomaly detection result determination module 730.

[0119] The timing signal acquisition module 710 is used to acquire multi-channel timing signals generated by the device under test during operation. The multi-channel timing signals characterize the operating state of each spatial position of the device under test at the current moment. In one embodiment, the timing signal acquisition module 710 can be used to perform the operation S210 described above, which will not be repeated here.

[0120] The anomaly scoring determination module 720 is used to input the multi-channel time-series signal into a pre-trained depth multi-ellipsoidal support vector data description model to obtain the anomaly score of the device under test at the current time. In one embodiment, the anomaly scoring determination module 720 can be used to perform the operation S220 described above, which will not be repeated here.

[0121] The anomaly detection result determination module 730 is used to determine the anomaly detection result based on the anomaly score. In one embodiment, the anomaly detection result determination module 730 can be used to perform the operation S230 described above, which will not be repeated here.

[0122] According to embodiments of this application, any multiple modules of the timing signal acquisition module 710, the anomaly scoring determination module 720, and the anomaly detection result determination module 730 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the timing signal acquisition module 710, the anomaly scoring determination module 720, and the anomaly detection result determination module 730 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the timing signal acquisition module 710, the anomaly scoring determination module 720, and the anomaly detection result determination module 730 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0123] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly detection method based on depth multi-ellipsoidal support vector data description, according to an embodiment of this application.

[0124] like Figure 8 As shown, an electronic device 800 according to an embodiment of this application includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0125] RAM 803 stores various programs and data required for the operation of electronic device 800. Processor 801, ROM 802, and RAM 803 are interconnected via bus 804. Processor 801 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 802 and / or RAM 803. It should be noted that the programs may also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0126] According to embodiments of this application, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to a bus 804. The electronic device 800 may also include one or more of the following components connected to the input / output (I / O) interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0127] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0128] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 802 and / or RAM 803 and / or one or more memories other than ROM 802 and RAM 803 described above.

[0129] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the anomaly detection method based on depth multi-ellipsoidal support vector data description provided in the embodiments of this application.

[0130] When the computer program is executed by the processor 801, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0131] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 809, and / or installed from a removable medium 811. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0132] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 901, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0133] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0134] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0135] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0136] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. An anomaly detection method based on depth multi-ellipsoidal support vector data description, characterized in that, The method includes: Acquire multi-channel timing signals generated by the device under test during operation, wherein the multi-channel timing signals characterize the operating state of each spatial position of the device under test at the current moment; The multi-channel time-series signal is input into a pre-trained depth multi-ellipsoidal support vector data description model to obtain the anomaly score of the device under test at the current time; and The anomaly detection result is determined based on the anomaly score; The deep multi-ellipsoidal support vector data description model is configured to: extract high-dimensional features of the multi-channel time-series signal based on a deep feature extraction network, wherein the high-dimensional features are used to characterize the coupling relationship between the multi-channel time-series signal and the operating state of the device under test; and calculate the minimum value of the squared Mahalanobis distance from the high-dimensional features to multiple hyperellipsoidal regions as the anomaly score.

2. The method according to claim 1, characterized in that, Pre-trained deep multi-ellipsoidal support vector data description models include: Collect multi-channel time-series signals of the device under test under various normal operating conditions as training data; Construct a target loss function, which measures the overall distribution compactness of the feature vector obtained after the training data is mapped by the deep feature extraction network within a normal data decision region composed of K hyperellipsoids, where K is an integer greater than 1; The parameters of the deep feature extraction network and the normal data decision region are trained based on the target loss function to obtain a deep multi-ellipsoid support vector data description model. The normal data decision region serves as the depth multi-ellipsoid support vector data description model. The K hyperellipsoids share the same common center, and their shapes and orientations are defined by K independent precision matrices.

3. The method according to claim 2, characterized in that, The parameters of the deep feature extraction network and the normal data decision region are trained based on the target loss function to obtain a deep multi-ellipsoid support vector data description model, including: The deep feature extraction network extracts the feature vector set of the training data. Based on the feature vector set, update the parameters of the normal data decision region; The value of the target loss function is calculated based on the parameters of the updated normal data decision region; The parameters of the deep feature extraction network are updated based on the value of the loss function; and Repeat the above steps until the preset training termination condition is met to obtain the trained depth multi-ellipsoidal support vector data description model.

4. The method according to claim 3, characterized in that, The parameters of the normal data decision region include a common center and K precision matrices. Updating the parameters of the normal data decision region based on the feature vector set includes: Update the public center based on the feature vector set; The feature vector set is divided into K subsets based on the directional distribution of each feature vector relative to the common center; and Calculate the precision matrix corresponding to the K subsets of feature vectors.

5. The method according to claim 4, characterized in that, The step of dividing the feature vector set into K feature vector subsets based on the directional distribution of each feature vector relative to the common center includes: Calculate the difference vector between each feature vector and the common center; Each difference vector is normalized to obtain a direction vector set corresponding to the feature vector set, wherein the direction vector set represents the directional distribution of the training data sample points relative to the common center. Cluster analysis is performed on the set of directional vectors, and the set of feature vectors is divided into K feature vector subsets based on the cluster analysis results.

6. The method according to claim 4, characterized in that, The calculation of the target loss function based on the parameters of the updated normal data decision region includes: For each feature vector in the subset of feature vectors, based on the updated common center and the precision matrix corresponding to the feature vector subset, calculate the squared Mahalanobis distance from the feature vector to the common center; and The value of the target loss function is obtained by summing and averaging the squared Mahalanobis distances.

7. The method according to any one of claims 1 to 6, characterized in that, The process of determining the anomaly detection result based on the anomaly score includes: The anomaly score is compared with an adaptive decision threshold; The anomaly detection results are determined based on the comparison results; The adaptive decision threshold is determined through the following steps: The abnormal scores obtained after inputting all normal training data into the deep multi-ellipsoidal support vector data description model constitute a score set. Based on a preset false alarm rate tolerance parameter, a quantile threshold is determined in the scoring set such that the proportion of samples in the scoring set that exceed the quantile threshold is less than the preset false alarm rate tolerance parameter. The quantile threshold is determined as the adaptive decision threshold.

8. An anomaly detection device based on depth multi-ellipsoidal support vector data description, characterized in that, The device includes: The timing signal acquisition module is used to acquire multi-channel timing signals generated by the device under test during operation. The multi-channel timing signals represent the operating status of each spatial position of the device under test at the current moment. An anomaly scoring and determination module is used to input the multi-channel time-series signal into a pre-trained depth multi-ellipsoidal support vector data description model to obtain the anomaly score of the device under test at the current time; and An anomaly detection result determination module is used to determine the anomaly detection result based on the anomaly score; The deep multi-ellipsoidal support vector data description model is configured to: extract high-dimensional features of the multi-channel time-series signal based on a deep feature extraction network, wherein the high-dimensional features are used to characterize the coupling relationship between the multi-channel time-series signal and the operating state of the device under test; and calculate the minimum value of the squared Mahalanobis distance from the high-dimensional features to multiple hyperellipsoidal regions as the anomaly score.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images