A graph-enhanced time-frequency dual-path anomaly detection method and system for multivariate time series data

Abstract

This invention discloses a graph-augmented time-frequency dual-path anomaly detection method and system for multivariate time series data. The method includes: cleaning and standardizing the original multivariate time series data; modeling the sensor network topology using a graph convolutional autoencoder to extract spatially enhanced sequence representations; inputting the sequence representations into a time-domain generation path and a frequency-domain discrimination path, respectively. The time-domain generation path combines a Transformer and a hierarchical variational autoencoder to model the temporal dynamics and generate a time-domain anomaly score, while the frequency-domain discrimination path analyzes the frequency domain distribution through context-aware spectral transform and generates a frequency-domain anomaly score; finally, the final anomaly score is obtained by fusing the time-domain and frequency-domain anomaly scores, thus achieving anomaly determination. This invention achieves high accuracy while possessing broad applicability, enabling precise detection of different types of industrial data, especially communication system data.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and time series anomaly detection, specifically involving a multivariate time series anomaly detection method and system based on graph structure enhancement and fusion of time and frequency domain information, which is particularly suitable for anomaly monitoring and diagnosis of multi-sensor data in complex systems such as 6G communication networks and smart grids. Background Technology

[0002] In complex systems such as the Industrial Internet of Things (IIoT) and 6G communication networks, numerous sensors continuously generate multivariate time-series data. Efficient and accurate anomaly detection of this data is crucial for ensuring the safe and stable operation of these systems. Traditional multivariate time-series anomaly detection methods primarily rely on time-domain modeling, such as reconstruction error detection methods based on recurrent neural networks (RNNs), long short-term memory networks (LSTMs), or variational autoencoders (VAEs). While these methods can capture certain time dependencies, they still have the following significant limitations:

[0003] 1. Insufficient utilization of frequency domain features: It is difficult to effectively detect significant anomalous patterns in the frequency domain by relying solely on time domain information, such as continuous vibration enhancement and periodic interference, which are more obvious in the frequency domain.

[0004] 2. Missing graph structure information: Sensors often have physical or logical topological connections. Traditional methods ignore this graph structure information, making it difficult to identify multi-sensor collaboration anomalies.

[0005] 3. Insufficient information fusion: Existing methods mostly focus on a single information source (time domain, frequency domain, or graph structure), lacking a systematic multimodal information fusion mechanism, which limits the detection capability of complex anomaly patterns.

[0006] In recent years, some studies have attempted to introduce graph neural networks or frequency domain analysis methods, but the organic unity of graph structure, temporal dynamics and frequency domain distribution has not yet been achieved, resulting in limited detection performance, especially when facing complex scenarios such as spectral shift and multi-sensor collaborative anomalies.

[0007] To address the aforementioned issues, this invention proposes a graph-enhanced time-frequency dual-path anomaly detection framework. It explicitly models the sensor topology using a graph convolutional autoencoder and constructs a time-domain generation path and a frequency-domain discrimination path, respectively. Finally, it achieves effective integration of multi-source anomaly scores through a time-frequency dual-path anomaly scoring fusion detection module, thereby significantly improving the accuracy and robustness of complex anomaly detection. Summary of the Invention

[0008] The purpose of this invention is to provide a graph-enhanced time-frequency dual-path anomaly detection method and system for multivariate time series data. It aims to solve the problem of anomaly detection in complex industrial systems such as 6G wireless communication and smart grids. By innovatively integrating graph structure information, time-domain dynamic features and frequency-domain distribution characteristics, a graph-enhanced time-frequency dual-path anomaly detection framework is constructed to achieve high-precision, robust, and low-false-alarm-rate anomaly diagnosis, effectively improving the safety monitoring and intelligent operation and maintenance level of complex systems.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A graph-enhanced time-frequency dual-path anomaly detection method for multivariate time series data includes the following steps:

[0011] Step 1: Collect multivariate time series data from multiple sensors in the original industrial sensor network, and perform data cleaning and standardization to obtain standardized multivariate time series data;

[0012] Step 2: Input the standardized multivariate time series data from Step 1 into the graph representation learning module based on graph convolutional autoencoder to obtain spatially enhanced sequence representations;

[0013] Step 3: Input the spatially enhanced sequence representation obtained in Step 2 into the temporal generation path module based on Transformer and hierarchical variational autoencoder, and output the temporal anomaly score.

[0014] Step 4: Input the spatially enhanced sequence representation obtained in Step 2 into the frequency domain discrimination path module based on context-aware spectral transform, and output the frequency domain anomaly score;

[0015] Step 5: Input the time-domain anomaly score obtained in Step 3 and the frequency-domain anomaly score obtained in Step 4 into the time-frequency dual-channel anomaly score fusion detection module. The final anomaly score is obtained through the fusion mechanism, thereby realizing anomaly detection of multivariate time series data.

[0016] Furthermore, step 2 specifically includes the following sub-steps:

[0017] Step 2.1, Obtain multivariate time series Using a sliding window to extract local time periods ,in, Indicates the number of time steps. This represents the number of sensor nodes, where t is the window index. For window length, Total number of windows;

[0018] Step 2.2, Construct the sensor network diagram ,in, For a set of nodes, Let be the set of edges. Let's consider the adjacency matrix. Based on expert knowledge and the Pearson correlation coefficient between sensors, and determined by the K-nearest neighbor algorithm;

[0019] Step 2.3: Transpose the data of each window into a node feature matrix:

[0020] ;

[0021] Step 2.4: Encode and reconstruct using a symmetric graph convolutional autoencoder (GCAE). The encoding process is as follows:

[0022] ;

[0023] in, To add self-connected adjacency matrices, This is the corresponding degree matrix. The weight matrix is ​​a learnable matrix; ReLU is the activation function; the encoder output is... , This represents the final dimension of the node features; l K represents the number of network layers in the encoder, where K is a specific real number.

[0024] The decoding process is mirror-symmetric, and the reconstructed output is ;

[0025] Step 2.5: Train a symmetric graph convolutional autoencoder (GCAE) by minimizing the reconstruction loss.

[0026] ;

[0027] in, Denotes the Frobenius norm;

[0028] Step 2.6: After training is complete, extract the node feature matrix output by the encoder. After being flattened into vectors, they are stacked to form a spatially enhanced sequence representation. ,in .

[0029] Furthermore, step 3 specifically includes the following sub-steps:

[0030] Step 3.1, Represent the spatially enhanced sequence. The input is a Transformer encoder, which learns temporal dependencies; the encoder output is... ;

[0031] Step 3.2, the Transformer is trained through an autoregressive prediction task, given a historical window. The Transformer decoder predicts the next window. The training loss is the mean squared error between the predicted and actual values.

[0032] ;

[0033] Step 3.3, output of the Transformer encoder Perform average pooling along the time dimension to obtain the global temporal feature vector: ;

[0034] in, Indicates the Transformer encoder at the 1st... The output vector at each time step Output feature dimension;

[0035] Step 3.4, Input Hierarchical Variational Autoencoder (HVAE) to model two-level latent variables Training is performed by maximizing the lower bound of evidence (ELBO).

[0036] Step 3.5, the time-domain anomaly score is calculated based on the reconstruction error and the KL divergence of the latent variables:

[0037]

[0038] in, and This is the balance coefficient; To generate the parameterized probability distribution of the model (decoder), These are used to generate model parameters; KL is the Kullback-Leibler divergence, used to measure the difference between two probability distributions; To infer the parameterized probability distribution of the model (encoder), To infer model parameters; For latent variables The prior distribution is usually set as the standard normal distribution. A higher score indicates a greater deviation from the normal time-series pattern.

[0039] Furthermore, step 4 specifically includes the following sub-steps:

[0040] Step 4.1, spatially enhanced sequence representation Perform Discrete Fourier Transform (DFT) channel by channel:

[0041]

[0042] in, Indicates the first The time series of each channel, where ω is the frequency index. The base of the natural logarithm, The imaginary unit;

[0043] Step 4.2: Based on expert knowledge, cluster time windows to identify multiple normal operating modes of the system. ,in For each normal pattern, the set of all normal patterns is defined; for each pattern... Extract its corresponding feature frequency subspace ,in, Indicates the first The most frequently occurring [number] in the normal operating mode Each characteristic frequency index;

[0044] Step 4.3: Perform context-aware spectral projection, retaining only... The frequency components within the range are used to construct a ternary spectral feature representation:

[0045]

[0046]

[0047]

[0048] in, For spectral amplitude, and Encode the sine and cosine components separately. This represents the amplitude of the projected spectrum, i.e., the context-aware spectrum. The modulus length is used to characterize the mode. Lower frequency Signal energy intensity at the location; and These are the frequency-related coefficients; obtained after concatenating the ternary features. ;

[0049] Step 4.4: Input the ternary spectral features into a lightweight convolutional network to extract the deep spectral representation:

[0050]

[0051] in, It is the ternary spectral feature tensor generated in step 4.3; Indicates use A convolutional neural network with convolutional kernels is used to capture local patterns in the frequency domain; It is the extracted deep spectral representation, dimension Where K is the feature frequency and D is the feature dimension;

[0052] Step 4.5: Reconstruct the temporal representation using context-aware inverse Fourier transform (IDFT) and calculate the reconstruction loss:

[0053]

[0054] in, For characteristic subspace Frequency components within;

[0055] Step 4.6, calculate the frequency domain anomaly score based on energy concentration:

[0056] in To normalize the spectral energy distribution, For pattern Energy concentration at the bottom;

[0057] Step 4.7: Standardize the scores for each mode, and take the minimum value among all modes as the final frequency domain anomaly score:

[0058] ;in, This indicates that the scoring for each mode is standardized.

[0059] Furthermore, step 5 specifically includes the following sub-steps.

[0060] Step 5.1: Score the time-domain anomalies. Frequency Domain Anomaly Scoring Perform normalization processing;

[0061] Step 5.2, combining maximum enhancement fusion and Mahalanobis distance fusion:

[0062]

[0063]

[0064] in These are the standard deviations of the scores under normal conditions. The correlation coefficient between the two is... For penalty weighting;

[0065] Step 5.3, the final fusion score is:

[0066] in Adjustable fusion weights;

[0067] Step 5.4: Set a threshold based on the normal sample score distribution. If If the threshold is exceeded, it is considered abnormal.

[0068] A system for implementing the graph-enhanced time-frequency dual-path anomaly detection method for multivariate time series data, comprising:

[0069] The data preprocessing module is used to clean and standardize the collected raw multivariate time series data;

[0070] The graph representation learning module receives standardized data and extracts spatially enhanced sequence representations based on a graph convolutional autoencoder.

[0071] The temporal analysis module is used to receive the spatially enhanced sequence representation and generate a temporal anomaly score based on Transformer and hierarchical variational autoencoder;

[0072] The frequency domain analysis module is used to receive the spatially enhanced sequence representation and generate a frequency domain anomaly score based on context-aware spectral transformation.

[0073] The fusion decision module is used to fuse the time-domain anomaly score and the frequency-domain anomaly score to generate a final anomaly score and output the anomaly determination result.

[0074] Furthermore, the graph representation learning module includes a unit for constructing a sensor network graph structure based on the Pearson correlation coefficient and the K-nearest neighbor algorithm.

[0075] Beneficial Effects: This invention achieves significant performance improvements on multiple real-world industrial datasets through innovative graph structure enhancement representation, time-frequency dual-path collaborative analysis, and anomaly scoring fusion detection mechanism, particularly demonstrating superiority in detecting complex anomaly patterns (such as spectral shift and multi-sensor collaborative anomalies). This method boasts advantages such as high accuracy, strong robustness, good generalization ability, and real-time performance, providing an effective technical means for intelligent operation and maintenance and safety monitoring of complex industrial systems such as 6G communication networks and smart grids.

[0076] To address the limitations of traditional methods, such as insufficient utilization of frequency domain features, lack of graph structure information, and inadequate fusion of multimodal information, this invention proposes a graph-enhanced time-frequency dual-path anomaly detection method. Compared with traditional methods, this method has the following significant advantages:

[0077] High detection accuracy: By explicitly modeling the sensor topology through graph convolutional autoencoder and combining dual verification of the time-domain generation path and the frequency-domain discrimination path, the detection rate of complex abnormal patterns is significantly improved.

[0078] Information fusion is comprehensive: For the first time, graph structure, time-domain dynamics and frequency-domain distribution are systematically unified into the same framework, achieving a comprehensive representation of multivariate time series.

[0079] Strong generalization ability: Based on an unsupervised learning framework, it can be trained without abnormal labels and is suitable for a variety of industrial scenarios;

[0080] Good real-time performance: It supports online detection and dynamic updates, and can promptly detect system anomalies and issue early warnings. Attached Figure Description

[0081] Figure 1 This is a flowchart of a graph-enhanced time-frequency dual-path anomaly detection method provided according to an embodiment of the present invention;

[0082] Figure 2 This is a schematic diagram of the structure of the Convolutional Autoencoder (GCAE) module in this invention;

[0083] Figure 3 A schematic diagram of the temporal path generation (Transformer-HVAE) module;

[0084] Figure 4 This is a schematic diagram of the structure of the frequency domain discrimination path (context-aware spectrum transformation module);

[0085] Figure 5 This is a schematic diagram of the time-frequency dual-path anomaly scoring fusion module. Detailed Implementation

[0086] The invention will now be further explained with reference to the accompanying drawings.

[0087] The present invention provides a graph-enhanced time-frequency dual-path anomaly detection method for multivariate time series data, comprising the following steps:

[0088] Step 1: Collect multivariate time series data from multiple sensors in the original industrial sensor network, and perform data cleaning and standardization to obtain standardized multivariate time series data;

[0089] Step 2: Input the standardized multivariate time series data from Step 1 into the graph representation learning module based on graph convolutional autoencoder to obtain spatially enhanced sequence representations;

[0090] In some preferred embodiments of the present invention, step 2 specifically includes the following sub-steps:

[0091] Step 2.1, given multivariate time series data ,in Indicates the number of time steps. This represents the number of sensor nodes. A sliding window method is used to extract local time periods. ,in For window length, This represents the total number of windows.

[0092] Step 2.2, Construct the sensor network diagram ,in For a set of nodes (corresponding to sensors). Let be the set of edges. This is the adjacency matrix. The construction combines expert knowledge (such as physical connections) with a data-driven approach: first, the Pearson correlation coefficient between each pair of sensor time series is calculated, and then the K-Nearest Neighbors (KNN) algorithm is used to select for each sensor. The most similar neighbors, if two sensors are each other's... For neighbors, add an edge between them.

[0093] Step 2.3: Transpose the data of each window into a node feature matrix, and use it as the input to the graph convolutional autoencoder:

[0094] This transpose operation transforms the time dimension into the node feature dimension, enabling graph convolution operations to aggregate spatial information between sensors.

[0095] Step 2.4: Encode and reconstruct using a symmetric graph convolutional autoencoder (GCAE). The encoder consists of... The convolutional layer consists of layers, the first layer... The layer is calculated as follows:

[0096]

[0097] in To add self-connected adjacency matrices, This is the corresponding degree matrix. The weight matrix is ​​learnable. ReLU is the activation function. Encoder output. ,in This represents the final dimension of the node features. l K represents the number of network layers in the encoder, where K is a real number.

[0098] The decoder structure is symmetrical to the encoder, reconstructing the input window through graph-like convolutional layers. The final decoder output... The time window for reconstruction is obtained after transposition. .

[0099] Step 2.5, the training objective of the graph convolutional autoencoder is to minimize the reconstruction loss:

[0100] in This represents the Frobenius norm. This loss function enables the encoder to learn a latent representation that can accurately reconstruct the original data.

[0101] Step 2.6: After training is complete, use the encoder to extract the spatial augmentation node feature matrix for each window. Flatten it into a vector ,in Stacking the vectors from all windows yields the final spatially augmented sequence representation. This representation captures both spatial dependencies and local temporal patterns between sensors.

[0102] Step 3: Input the spatially enhanced sequence representation obtained in Step 2 into the temporal generation path module based on Transformer and hierarchical variational autoencoder, and output the temporal anomaly score.

[0103] In some preferred embodiments of the present invention, step 3 specifically includes the following sub-steps:

[0104] Step 3.1, Represent the spatially enhanced sequence. The input sequence is fed into a Transformer encoder, which learns long-range temporal dependencies within the sequence. The Transformer encoder processes the input sequence through a multi-head self-attention mechanism and a feedforward neural network layer, outputting a context-sensitive temporal representation. ,in This is the output feature dimension.

[0105] Step 3.2, the Transformer is trained through an autoregressive prediction task: given a historical window The Transformer decoder predicts the next window. The training loss is the mean squared error between the predicted and actual values.

[0106] This training strategy enables the Transformer to learn robust temporal dynamics and long-range dependencies.

[0107] Step 3.3, output of the Transformer encoder Perform average pooling along the time dimension to obtain the global temporal feature vector:

[0108] This vector summarizes the temporal information of the entire sequence.

[0109] in, Indicates the Transformer encoder at the 1st... The output vector at each time step This is the output feature dimension.

[0110] Step 3.4, convert the global temporal feature vector Input Hierarchical Variational Autoencoder (HVAE). HVAE employs a two-level latent variable structure. To model the multi-scale latent distribution of the data. The inference model (encoder) is defined as follows:

[0111] The variational posterior distribution is a Gaussian distribution:

[0112]

[0113]

[0114] The generative model (decoder) is based on prior knowledge. and conditional distribution Define and reconstruct .

[0115] Step 3.5, HVAE is trained by maximizing the lower bound of evidence (ELBO):

[0116]

[0117] in and These are adjustable weights used to control the strength of KL divergence regularization.

[0118] Step 3.6, Time Domain Anomaly Scoring It is composed of the reconstruction error and the KL divergence of the latent variables:

[0119]

[0120] in and This is the balance coefficient; To generate the parameterized probability distribution of the model (decoder), These are used to generate model parameters; KL is the Kullback-Leibler divergence, used to measure the difference between two probability distributions; To infer the parameterized probability distribution of the model (encoder), To infer model parameters; For latent variables The prior distribution is usually set as the standard normal distribution. The higher the score, the greater the deviation of the current sample from the normal time-domain pattern, and the higher the probability of an anomaly.

[0121] Step 4: Input the spatially enhanced sequence representation obtained in Step 2 into the frequency domain discrimination path module based on context-aware spectral transform, and output the frequency domain anomaly score;

[0122] In some preferred embodiments of the present invention, step 4 specifically includes the following sub-steps:

[0123] Step 4.1, spatially enhanced sequence representation Each channel (i.e., each feature dimension) Perform a Discrete Fourier Transform (DFT) to transform it from the time domain to the frequency domain:

[0124]

[0125] in Indicates the first Time series of each channel For frequency index, The base of the natural logarithm, It is the imaginary unit.

[0126] DFT reveals the energy distribution of a signal at different frequencies.

[0127] Step 4.2: Cluster the time window based on expert knowledge (such as system operating modes) (e.g., using the K-means algorithm) to identify multiple normal operating modes of the system. For each mode Count the strongest frequency components in all sliding windows and select the components with the highest frequency. A number of frequency indices constitute the characteristic frequency subspace of this mode:

[0128]

[0129] This design establishes a unique "spectral fingerprint" for each normal mode and reduces computational complexity through sparse representation.

[0130] Step 4.3, perform context-aware spectral transformation: retain only the characteristic frequency subspace. The frequency components within the spectrum are used to obtain the projected spectrum. Based on this, a ternary spectral feature representation is constructed to enhance the discriminative ability:

[0131]

[0132] in For spectral amplitude, and Encode the sine and cosine components separately. and These are the frequency-related coefficients. The ternary features are concatenated to obtain... It also captured the spectral energy distribution and waveform information.

[0133] Step 4.4, extract the ternary spectral features. Input lightweight convolutional network (using Convolutional kernels extract deep spectral representations Convolution operations can capture local patterns in the frequency-channel space.

[0134] Step 4.5 reconstructs the time-domain representation using the context-aware inverse discrete Fourier transform (IDFT), which uses only the feature subspace. Frequency components within:

[0135]

[0136] Reconstruction loss is defined as:

[0137]

[0138] This loss measures the difference between the original sequence and the reconstructed sequence based on selected frequency components.

[0139] Step 4.6, Frequency Domain Anomaly Scoring is based on the principle of energy concentration: the spectral energy of a normal sample should be highly concentrated in the characteristic frequency subspace of its corresponding mode. Within the sample, the energy distribution of anomalous samples is more dispersed. First, the normalized spectral energy distribution is calculated:

[0140]

[0141] Then the pattern The energy concentration is as follows:

[0142]

[0143] normal samples Values ​​close to 1 indicate abnormal samples. The value is low. The frequency domain anomaly score is defined as:

[0144]

[0145] Standardize the scores for each pattern to eliminate inter-pattern bias:

[0146]

[0147] in and Pattern on the training set The mean and standard deviation of the scores. The final frequency domain anomaly score is the minimum value among all modes:

[0148]

[0149] The minimum value operation ensures that any normal pattern is significantly deviated from, thus improving detection sensitivity.

[0150] Step 5: Input the time-domain anomaly score obtained in Step 3 and the frequency-domain anomaly score obtained in Step 4 into the time-frequency dual-channel anomaly score fusion detection module. The final anomaly score is obtained through the fusion mechanism, thereby realizing anomaly detection of multivariate time series data.

[0151] In some preferred embodiments of the present invention, step 5 specifically includes the following sub-steps:

[0152] Step 5.1: Score the time-domain anomalies. Frequency Domain Anomaly Scoring Normalize it to make it comparable.

[0153] Step 5.2, design a dual-path fusion mechanism, combining two complementary fusion strategies:

[0154] Maximum Enhancement Fusion: This strategy emphasizes significant anomaly indications in either channel and imposes a penalty when the two channels are inconsistent.

[0155]

[0156] in The penalty weights are used to ensure that high anomaly scores in either channel are reflected in the fusion result; the penalty term amplifies the anomaly signal when the two channels diverge.

[0157] Mahalanobis distance fusion: This strategy statistically quantifies the overall deviation of the sample from the normal pattern based on the joint distribution of time-frequency scores in the normal pattern.

[0158]

[0159] in and These represent the standard deviations of the time-domain and frequency-domain scores under normal mode, respectively. Let be the correlation coefficient between the two. This formula takes into account the statistical correlation between time-frequency scores, and degenerates into a weighted sum of squares when the two are independent.

[0160] Step 5.3: The final fusion score is a weighted combination of the two fusion results.

[0161]

[0162] in The fusion weights are adjustable and can be optimized on the validation set based on performance metrics such as F1 score.

[0163] Step 5.4: Set the detection threshold based on the fusion score distribution of normal samples. (For example, using high quantiles to control the false alarm rate). For online detection samples, if their fusion score... If it is, it is considered abnormal; otherwise, it is considered normal.

[0164] Based on the above method, the present invention provides a system for implementing the graph-enhanced time-frequency dual-path anomaly detection method for multivariate time series data, comprising:

[0165] The data preprocessing module is used to clean and standardize the collected raw multivariate time series data;

[0166] The graph representation learning module receives standardized data and extracts spatially enhanced sequence representations based on a graph convolutional autoencoder. The graph representation learning module includes a unit for constructing a sensor network graph structure based on the Pearson correlation coefficient and the K-nearest neighbor algorithm.

[0167] The temporal analysis module is used to receive the spatially enhanced sequence representation and generate a temporal anomaly score based on Transformer and hierarchical variational autoencoder;

[0168] The frequency domain analysis module is used to receive the spatially enhanced sequence representation and generate a frequency domain anomaly score based on context-aware spectral transformation.

[0169] The fusion decision module is used to fuse the time-domain anomaly score and the frequency-domain anomaly score to generate a final anomaly score and output the anomaly determination result.

[0170] The present invention will be further described below with reference to the embodiments.

[0171] Example

[0172] Reference Figure 1 In this embodiment, the graph-enhanced time-frequency dual-path anomaly detection method includes the following main steps:

[0173] Step S1: Data Acquisition and Preprocessing

[0174] Collect multivariate time-series data from industrial sensor networks and perform the following preprocessing:

[0175] Missing value handling: Missing values ​​are filled using linear interpolation.

[0176] Noise filtering: Use a moving average filter to smooth high-frequency noise;

[0177] Standardization: Z-score standardization is performed on the data from each sensor channel to eliminate the influence of dimensions.

[0178] Step S2: Graph Reinforcement Representation Learning

[0179] Reference Figure 2 The preprocessed data is input into the graph convolutional autoencoder (GCAE) module to extract spatially enhanced sequence representations.

[0180] Graph Structure Construction: A graph structure is constructed based on the physical connections and time-series correlations between sensors. The Pearson correlation coefficient matrix between sensors is calculated, and the K-Nearest Neighbors (KNN) algorithm is used to determine adjacency relationships. This is then combined with expert-defined prior connections to form the final adjacency matrix. .

[0181] Graph Convolutional Autoencoder Processing: A symmetric graph convolutional autoencoder (GCAE) is used to encode and reconstruct multivariate time series data. The encoder aggregates neighbor node information through multiple layers of graph convolution operations to extract spatially enhanced feature representations; the decoder symmetrically reconstructs the input data. The training objective is to minimize the reconstruction loss. This enables the encoder to learn to accurately reconstruct the latent representation of the original data.

[0182] Feature extraction: After training, the node feature matrices output by the GCAE encoder are extracted, flattened, and stacked to form a spatially augmented sequence representation. ,in The number of time windows. For feature dimensions.

[0183] Step S3: Time-domain generation path anomaly scoring

[0184] Reference Figure 3 Representing spatially enhanced sequences Input the time-domain generation path module to calculate the time-domain anomaly score:

[0185] Transformer temporal encoding: The Transformer encoder is used to capture long-range temporal dependencies in a sequence. The model is trained through an autoregressive prediction task to learn robust temporal dynamic patterns.

[0186] Temporal feature aggregation: Temporal average pooling is performed on the Transformer output to obtain the global temporal feature vector. .

[0187] Hierarchical variational autoencoder modeling: The input hierarchical variational autoencoder (HVAE) employs a two-level latent variable structure. The model employs a multi-scale latent distribution model. HVAE is trained by maximizing the lower bound of evidence (ELBO), with the loss function being:

[0188]

[0189] Time-domain anomaly score calculation: Calculating time-domain anomaly scores based on reconstruction error and KL divergence of latent variables. A higher score indicates a greater deviation from the normal time series pattern.

[0190] Step S4: Frequency Domain Path Anomaly Scoring

[0191] Reference Figure 4 Representing spatially enhanced sequences Input the frequency domain discrimination path module to calculate the frequency domain anomaly score:

[0192] Frequency domain transformation and pattern recognition: Channel-by-channel Discrete Fourier Transform (DFT) is performed to transform the time-domain signal into the frequency domain. Based on expert knowledge, time windows are clustered to identify multiple normal operation modes, and a feature frequency subspace is extracted for each mode. .

[0193] Context-aware spectral analysis: Only frequency components within the feature frequency subspace are retained, constructing a ternary spectral feature including amplitude, sine component, and cosine component. A lightweight convolutional network is used to extract a deep spectral representation, and a context-aware inverse Fourier transform is used to reconstruct the time-domain representation.

[0194] Energy concentration analysis: Calculate the normalized spectral energy distribution and analyze the degree of energy concentration within the characteristic frequency subspace. The energy of a normal sample should be highly concentrated in the frequency subspace of the corresponding mode.

[0195] Frequency Domain Anomaly Score Calculation: Calculating Frequency Domain Anomaly Scores Based on Energy Concentration The minimum value of the standardized scores for each mode is taken as the final frequency domain score to ensure detection sensitivity.

[0196] Step S5: Fusion of Time-Frequency Dual-Path Anomaly Scoring

[0197] Reference Figure 5 Time-domain anomaly scoring Frequency Domain Anomaly Scoring Input fusion detection module:

[0198] Scoring normalization: The time-domain and frequency-domain scores are standardized to make them comparable.

[0199] Dual-path fusion: Combining maximum enhancement fusion and Mahalanobis distance fusion strategies.

[0200] - Maximum Enhanced Fusion:

[0201] Mahalanobis distance fusion: Statistical quantification of sample bias based on joint distribution of time-frequency scores

[0202]

[0203] Weighted combination: Final fusion score is ,in The fusion weights are adjustable.

[0204] Anomaly detection: Thresholds are set based on the normal sample fusion score distribution. ,like If so, it is considered abnormal.

[0205] To verify the effectiveness of the method of this invention, experiments were conducted on three real industrial datasets: SWAT, SMD, and WCD. The experimental setup and results are described below using the WCD dataset as an example.

[0206] Experimental setup

[0207] Dataset: The WCD dataset contains 57 sensor variables, 33,000 time steps, and an anomaly rate of approximately 8.16%.

[0208] Comparison methods: Compared with mainstream methods such as AE, LSTM-VAE, DAGMM, OmniAnomaly, Anomaly Transformer, and MTAD-GAT.

[0209] AE (AutoEncoder): A classic reconstruction-based anomaly detection method that uses a symmetric structure to encode and decode the input sequence, with anomaly scores based on reconstruction error.

[0210] LSTM-VAE: A time series modeling method that combines long short-term memory networks and variational autoencoders, capable of capturing long-range dependencies and latent representations in time series data.

[0211] DAGMM combines autoencoders and Gaussian mixture models to perform low-dimensional embedding and probabilistic modeling through joint optimization, making it suitable for anomaly identification under complex distributions.

[0212] OmniAnomaly employs variational recursive structure and latent variable modeling, which can effectively handle anomaly detection in multivariate time series data.

[0213] Anomaly Transformer: Introduces an attention-guided contrastive learning mechanism that uses attention distribution to model the differences between normal and abnormal, achieving leading performance on multiple datasets.

[0214] MTAD-GAT: It uses graph attention mechanism (GAT) and multi-scale modeling structure to focus on the correlation information between multiple variables and enhances the representation ability by utilizing temporal nesting structure.

[0215] Evaluation metrics: Precision, Recall, F1 score

[0216] Experimental results

[0217] Table 1 shows the performance comparison of each method on the WCD dataset:

[0218] Table 1 Key performance indicators of mainstream anomaly detection methods on the WCD dataset

[0219] method Accuracy Recall rate F1 score AE 0.736 0.522 0.611 LSTM-VAE 0.743 0.593 0.660 DAGMM 0.424 0.237 0.304 OmniAnomaly 0.765 0.632 0.692 Anomaly Transformer 0.700 0.769 0.732 MTAD-GAT 0.787 0.474 0.592 GTF-AD (This invention) 0.791 0.775 0.782

[0220] Experimental results show that the method of the present invention achieves the best precision, recall and F1 score on the WCD dataset, which is significantly better than existing methods.

[0221] ablation experiment

[0222] To further verify the contribution of each module, ablation experiments were conducted, and the results are shown in Table 2:

[0223] Table 2 Ablation Experiment Results

[0224] variants SWaT (F1) SMD (F1) WCD (F1) Remove the graph representation learning module (GTF-AD\G) 0.852 0.856 0.710 Remove frequency domain path (GTF-AD\F) 0.857 0.879 0.691 Remove the time-domain path (GTF-AD\T) 0.789 0.813 0.614 Complete Model (GTF-AD) 0.901 0.909 0.782

[0225] Ablation experiments show that the graph enhancement module, the time-domain generation path, and the frequency-domain discrimination path all make significant contributions to the final performance, with the complete model showing the best results.

[0226] This invention achieves high-precision anomaly detection in multivariate time series data through graph structure-enhanced representation learning, time-frequency dual-path collaborative analysis, and fusion mechanisms. Experiments demonstrate that this method outperforms existing technologies on multiple industrial datasets and has significant practical application value.

[0227] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A graph-enhanced time-frequency dual-path anomaly detection method for multivariate time series data, characterized in that: Includes the following steps: Step 1: Collect multivariate time series data from multiple sensors in the original industrial sensor network, and perform data cleaning and standardization to obtain standardized multivariate time series data; Step 2: Input the standardized multivariate time series data from Step 1 into the graph representation learning module based on graph convolutional autoencoder to obtain spatially enhanced sequence representations; Step 3: Input the spatially enhanced sequence representation obtained in Step 2 into the temporal generation path module based on Transformer and hierarchical variational autoencoder, and output the temporal anomaly score. Step 4: Input the spatially enhanced sequence representation obtained in Step 2 into the frequency domain discrimination path module based on context-aware spectral transform, and output the frequency domain anomaly score; Step 5: Input the time-domain anomaly score obtained in Step 3 and the frequency-domain anomaly score obtained in Step 4 into the time-frequency dual-channel anomaly score fusion detection module. The final anomaly score is obtained through the fusion mechanism, thereby realizing anomaly detection of multivariate time series data.

2. The method according to claim 1, characterized in that: Step 2 specifically includes the following sub-steps: Step 2.1, Obtain multivariate time series Using a sliding window to extract local time periods ,in, Indicates the number of time steps. This represents the number of sensor nodes, where t is the window index. For window length, Total number of windows; Step 2.2, Construct the sensor network diagram ,in, For a set of nodes, Let be the set of edges. Let's consider the adjacency matrix. Based on expert knowledge and the Pearson correlation coefficient between sensors, and determined by the K-nearest neighbor algorithm; Step 2.3: Transpose the data of each window into a node feature matrix: ； Step 2.4: Encode and reconstruct using a symmetric graph convolutional autoencoder. The encoding process is as follows: ； in, To add self-connected adjacency matrices, This is the corresponding degree matrix. The weight matrix is ​​a learnable matrix; ReLU is the activation function; the encoder output is... , This represents the final dimension of the node features; l K represents the number of network layers in the encoder, where K is a specific real number. The decoding process is mirror-symmetric, and the reconstructed output is ; Step 2.5: Train a symmetric graph convolutional autoencoder by minimizing the reconstruction loss. ； in, Denotes the Frobenius norm; Step 2.6: After training is complete, extract the node feature matrix output by the encoder. After being flattened into vectors, they are stacked to form a spatially enhanced sequence representation. ,in .

3. The method according to claim 1, characterized in that: Step 3 specifically includes the following sub-steps: Step 3.1, Represent the spatially enhanced sequence. The input is a Transformer encoder, which learns temporal dependencies; the encoder output is... ; Step 3.2, the Transformer is trained through an autoregressive prediction task, given a historical window. The Transformer decoder predicts the next window. The training loss is the mean squared error between the predicted and actual values. ； Step 3.3, output of the Transformer encoder Perform average pooling along the time dimension to obtain the global temporal feature vector: ; in, Indicates the Transformer encoder at the 1st... The output vector at each time step Output feature dimension; Step 3.4, Input hierarchical variational autoencoder to model two-level latent variables Training is performed by maximizing the lower bound of evidence; Step 3.5, the time-domain anomaly score is calculated based on the reconstruction error and the KL divergence of the latent variables: in, and This is the balance coefficient; To generate the parameterized probability distribution of the model, These are used to generate model parameters; KL is the Kullback-Leibler divergence, used to measure the difference between two probability distributions; To infer the parameterized probability distribution of the model, To infer model parameters; For latent variables The prior distribution is usually set as the standard normal distribution. A higher score indicates a greater deviation from the normal time-series pattern.

4. The method according to claim 1, characterized in that: Step 4 specifically includes the following sub-steps: Step 4.1, spatially enhanced sequence representation Perform Discrete Fourier Transform on each channel: in, Indicates the first The time series of each channel, where ω is the frequency index. Let be the base of the natural logarithm. The imaginary unit; Step 4.2: Based on expert knowledge, cluster time windows to identify multiple normal operating modes of the system. ,in For each normal pattern, the set of all normal patterns is defined; for each pattern... Extract its corresponding feature frequency subspace ,in, Indicates the first The most frequently occurring [number] in the normal operating mode Each characteristic frequency index; Step 4.3: Perform context-aware spectral projection, retaining only... The frequency components within the range are used to construct a ternary spectral feature representation: in, For spectral amplitude, and Encode the sine and cosine components separately. This represents the amplitude of the projected spectrum, i.e., the context-aware spectrum. The modulus length is used to characterize the mode. Lower frequency Signal energy intensity at the location; and These are the frequency-related coefficients; obtained after concatenating the ternary features. ; Step 4.4: Input the ternary spectral features into a lightweight convolutional network to extract the deep spectral representation: in, It is the ternary spectral feature tensor generated in step 4.3; Indicates use A convolutional neural network with convolutional kernels is used to capture local patterns in the frequency domain; It is the extracted deep spectral representation, dimension Where K is the feature frequency and D is the feature dimension; Step 4.5: Reconstruct the temporal representation using context-aware inverse Fourier transform and calculate the reconstruction loss: in, For characteristic subspace Frequency components within; Step 4.6, calculate the frequency domain anomaly score based on energy concentration: in To normalize the spectral energy distribution, For pattern Energy concentration at the bottom; Step 4.7: Standardize the scores for each mode, and take the minimum value among all modes as the final frequency domain anomaly score: ;in, This indicates that the scoring for each mode is standardized.

5. The method according to claim 1, characterized in that: Step 5 specifically includes the following sub-steps. Step 5.1: Score the time-domain anomalies. Frequency Domain Anomaly Scoring Perform normalization processing; Step 5.2, combining maximum enhancement fusion and Mahalanobis distance fusion: in These are the standard deviations of the scores under normal conditions. The correlation coefficient between the two is... For penalty weighting; Step 5.3, the final fusion score is: in Adjustable fusion weights; Step 5.4: Set a threshold based on the normal sample score distribution. If If the threshold is exceeded, it is considered abnormal.

6. A system for implementing the graph-enhanced time-frequency dual-path anomaly detection method for multivariate time series data as described in claim 1, characterized in that: include: The data preprocessing module is used to clean and standardize the collected raw multivariate time series data; The graph representation learning module receives standardized data and extracts spatially enhanced sequence representations based on a graph convolutional autoencoder. The temporal analysis module is used to receive the spatially enhanced sequence representation and generate a temporal anomaly score based on Transformer and hierarchical variational autoencoder; The frequency domain analysis module is used to receive the spatially enhanced sequence representation and generate a frequency domain anomaly score based on context-aware spectral transformation. The fusion decision module is used to fuse the time-domain anomaly score and the frequency-domain anomaly score to generate a final anomaly score and output the anomaly determination result.

7. The system according to claim 6, characterized in that: The graph representation learning module includes a unit for constructing a sensor network graph structure based on the Pearson correlation coefficient and the K-nearest neighbor algorithm.

Images