Industrial time series data anomaly detection method, device and equipment and storage medium
The industrial time series data anomaly detection method, which introduces DITC network and adversarial reconstruction module, solves the modeling problem of transient and long-term features in multivariate time series, enhances the ability to identify abnormal patterns, and improves detection performance and stability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JIANGXI NORMAL UNIV
- Filing Date
- 2026-04-07
- Publication Date
- 2026-07-03
AI Technical Summary
Existing reconstruction-based industrial multivariate time series anomaly detection models are difficult to simultaneously and effectively characterize transient anomalies during equipment operation and the overall system evolution pattern. Furthermore, they are easily affected by unknown anomalies or noise during unsupervised or weakly supervised training, leading to a decline in detection performance.
A dual interactive temporal convolutional (DITC) network is introduced, which combines an adversarial reconstruction module and a U-shaped autoencoder to enhance feature representation capabilities through local and global feature extraction. It also suppresses abnormal interference through an adversarial reconstruction mechanism and adopts a peak over-threshold method to adaptively determine anomalies.
It significantly improves the ability to identify complex industrial faults and cyber threats, reduces the false negative rate, and enhances the stability and practicality of the detection system.
Smart Images
Figure CN122333271A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data detection technology, and in particular to a method, apparatus, equipment and storage medium for detecting anomalies in industrial time-series data. Background Technology
[0002] In recent years, deep learning-based multivariate time series anomaly detection methods have gradually become the mainstream research direction in this field. Related research, by introducing model structures such as autoencoders, recurrent neural networks, convolutional neural networks, and Transformers, has demonstrated significant advantages in feature representation learning and complex pattern modeling, effectively capturing nonlinear dependencies in time series data and thus improving the overall performance of anomaly detection. In particular, reconstruction-based anomaly detection methods, by learning the inherent structure of normal data and using reconstruction errors as the basis for anomaly discrimination, have achieved good detection results in unsupervised or weakly supervised scenarios.
[0003] However, despite the aforementioned methods improving anomaly detection accuracy to some extent, anomaly detection models based on reconstructed industrial multivariate time series (such as multi-sensor device monitoring data, network traffic monitoring logs, or multidimensional performance indicators) still face numerous challenges. First, in real-world industrial scenarios, such multivariate time series often simultaneously contain dynamic features at different time scales, such as short-term localized bursts in equipment sensors and long-term performance degradation trends across cycles. However, some existing reconstruction-based anomaly detection models still have limitations in feature modeling capabilities, making it difficult to effectively characterize both transient anomalies during equipment operation and the overall system evolution pattern. This deficiency in multi-scale feature extraction capabilities makes the models prone to losing key information or insufficient feature representation when faced with complex, multi-scale time series data from industrial sites, thus limiting further improvements in reconstruction quality. Second, in actual industrial or network data, the number of anomaly patterns (such as equipment failure precursors or network attack behaviors) is usually unknown, and the overall data distribution often exhibits complex mixed characteristics, making it difficult for models to stably and reliably characterize normal operating conditions or baseline traffic patterns. During unsupervised or weakly supervised training, mixed anomalous samples inevitably participate in model learning, thus interfering with the encoder's feature extraction process. When these anomalies or noise are incorrectly included in the latent representation space, the feature distribution learned by the model will no longer be pure, thereby weakening the reconstruction model's ability to model normal behavior patterns. Furthermore, when anomalous features overlap with normal baselines in the latent space, the model may produce better reconstruction results for faulty or attack samples, reducing the discriminative power of the anomaly score and ultimately leading to a decline in anomaly detection performance. Summary of the Invention
[0004] This application provides a method, apparatus, device, and storage medium for anomaly detection in industrial time-series data. By introducing a dual interactive temporal convolutional (DITC) network, it jointly models short-term transient patterns (such as sudden equipment jitter or traffic spikes) and long-term evolution patterns (such as equipment performance degradation or periodic changes in business traffic) in multi-dimensional time series data from industrial equipment sensors or network monitoring data, thereby effectively enhancing feature extraction capabilities. Based on this, the model further integrates an adversarial reconstruction module based on a Transformer encoder and a U-shaped autoencoder structure to collaboratively model and reconstruct multi-scale temporal features from multi-dimensional time-series data from industrial sites or network environments. Specifically, the adversarial reconstruction mechanism introduces discriminative constraints, prompting the model to pay more attention to fine-grained anomaly features that are difficult to reconstruct in industrial scenarios (such as early fault symptoms or covert attack behaviors); while the U-shaped autoencoder, relying on its multi-level encoder-decoder structure and skip connections, effectively preserves global contextual information across equipment operating cycles or business time windows. The two work together to improve the quality of reconstruction of normal operating conditions or traffic patterns, while significantly enhancing the model's ability to identify abnormal patterns such as complex industrial faults or network threats, thereby improving the overall anomaly detection performance.
[0005] In a first aspect, this application provides a method for detecting anomalies in industrial time-series data, including: The multivariate time series data to be detected is acquired and preprocessed to obtain a set of window sequences; wherein the multivariate time series data comes from industrial equipment sensors or network traffic monitoring systems. The window sequences in the set of window sequences are input into a dual-interactive temporal convolutional network to extract local temporal features and global temporal features, respectively. A dual-structure autoencoder, including an adversarial reconstruction module and a U-shaped autoencoder, is used to reconstruct the local temporal features and global temporal features to obtain local reconstruction output and global reconstruction output. Based on the local reconstruction output, global reconstruction output, and original input, the combined reconstruction loss is calculated, and the model parameters of the dual-interactive temporal convolutional network and the dual-structure autoencoder are jointly optimized based on the combined reconstruction loss. The reconstruction error of each time window is calculated as an anomaly score based on the trained model, and the anomaly judgment threshold is adaptively determined based on the peak over threshold method to identify abnormal data points.
[0006] In one possible design, the multivariate time series data to be detected is acquired and preprocessed to obtain a set of window sequences, including: The multivariate time series data is normalized using the following formula to obtain the normalized signal: (3) in The signal is normalized. and It is a vector containing the maximum and minimum values of each feature dimension in the training set; It is a small constant set to prevent division by zero; X It is a multivariate time series; These are observations in a multivariate time series; Data enhancement is performed on the normalized signal by injecting white noise to maintain the overall signal-to-noise ratio at a preset value; the formula for calculating the signal-to-noise ratio is: (4) in SNR For signal-to-noise ratio, t For a moment, N Indicates the number of samples in the dataset; It is white noise; The formula for calculating data augmentation is: (5) A sliding window mechanism is used to segment the enhanced time series into a set of window sequences of fixed length; wherein, at each timestamp t Define a fixed length at that location. τ The time window, and the corresponding segment, are represented as follows: (6) in W t Represents timestamp t The window sequence at that location, x t-τ+1 , x t-τ+2 , x t-τ These represent observations at different timestamps. R Let m denote the set of real numbers. Dimensions.
[0007] In one possible design, the dual-interactive temporal convolutional network includes a local interactive temporal convolutional module and a global interactive temporal convolutional module; The local interactive temporal convolution module is used to extract short-term dependencies, and its processing includes: processing the input window sequence... W t Feature extraction and interaction are performed through bi-branch causal convolutions with different kernel sizes: (7) (8) in and This represents causal convolutional blocks with different kernel sizes. Represents the GELU activation function. and These are the first and second intermediate features after the interaction; The first and second intermediate features after the interaction are summed and passed through a second causal convolutional block to obtain local temporal features. O LITC ; The global interactive temporal convolution module calculates the global temporal features using the following formula: (10) (11) (12) (13) in , and This represents dilated convolutional blocks with different kernel sizes; B 1. B 2 and B 3 indicates an intermediate transition variable; O GITC It represents global temporal characteristics.
[0008] In one possible design, the dual-structure autoencoder includes an adversarial reconstruction module and a U-shaped autoencoder; The adversarial reconstruction module includes an encoder, a normal data decoder, and an abnormal data decoder equipped with a gradient inversion layer. The normal data stream is reconstructed by the encoder and normal data decoder to produce a partially reconstructed output. The local reconstruction loss is defined as: (14) in L Local This represents the local reconstruction loss. Indicates the first i A normal observation value, n Indicates the number of normal observations. This represents the corresponding normal input window. Represents a normal data decoder. and These represent the decoder's built-in parameters. E Indicates encoder; The gradient inversion layer inverts the gradient during backpropagation, as described in the following operation: (15) in It is the gradient flowing from the self-decoder to the gradient inversion layer. It is the inverse gradient that is passed back to the encoder. It is a parameter that controls the intensity of the reversal; L Indicates the number of layers in the encoder; Abnormal data is generated by injecting Gaussian noise into normal data. x A : (16) in It is a noise vector sampled from a standard Gaussian distribution. It is a parameter that controls the intensity of the disturbance. This is normal data; The abnormal data is reconstructed adversarially using the encoder and the abnormal data decoder, wherein the reconstruction loss of the abnormal data is defined as: (17) in L A This represents the reconstruction loss of anomalous data. and express i Abnormal inputs and outputs at all times This indicates an abnormal data decoder. This indicates a decoder exception built-in parameter. express i Time-based abnormal sequences; During backpropagation, the reconstruction loss of anomalous data is propagated backward through the gradient reversal layer to achieve adversarial learning. The final adversarial loss is expressed as: (18) in L Rev It signifies resistance to loss.
[0009] In one possible design, the U-shaped autoencoder consists of a multi-layer symmetrical encoder and a decoder; wherein the encoder adopts a layered compression strategy, and each layer performs a nonlinear mapping on the output of the previous layer, gradually extracting time features from shallow to deep layers. The input of the encoder is represented as follows: (19) in and These are the inputs to the i-th and (i-1)-th layers of the encoder. It is the output of the global interactive convolution module. LThis represents the total number of encoder layers; The output of each encoder layer is given by the following formula: (20) in It is the output of the i-th layer of the encoder. This represents the i-th encoder layer; The decoder adopts a hierarchical structure symmetrical to the encoder, and gradually reconstructs the multi-scale features extracted by the encoder. Each decoding layer receives the output of the previous decoder layer and integrates the skip connections from the corresponding encoder layer. The input to the decoder is represented as follows: (twenty one) in and These represent the input and output of the i-th layer of the decoder, respectively. FFN Indicates feedforward layer; The output of the decoder is represented as follows: (twenty two) in This represents the i-th decoder layer; The output of the U-shaped self-encoder As the output of global reconstruction, its global reconstruction loss is defined as: (twenty three) in L Global Indicates the global reconstruction loss; This represents the output of the global interactive convolutional block. express i The reconstruction result after global feature extraction at any time step.
[0010] In one possible design, the reconstruction error for each time window is calculated as an anomaly score based on the trained model, and an anomaly threshold is adaptively determined based on a peak-to-threshold method to identify anomalous data points, including: The reconstruction error is used as the outlier score, and the generalized Pareto distribution is used to identify outliers exceeding the initial outlier score threshold. Model the extreme value part: (twenty four) in This represents the extreme value exceeding the threshold. s The extreme value follows the parameter: and The generalized Pareto distribution, S Indicates an abnormal sequence Final anomaly detection threshold The calculation formula is: (25) in This represents the probability of a target exceeding a threshold. It is the total number of observations. Peak value China satisfies Quantity, parameters and It is obtained through the maximum likelihood estimation method; Will exceed the final anomaly determination threshold The data points were identified as abnormal data points.
[0011] In one possible design, the combined reconstruction loss is expressed as: (26) in L T For the combined reconstruction loss, Indicates hyperparameters, L Local This represents the local reconstruction loss. L Global Indicates the global reconstruction loss. L Rev It signifies resistance to loss.
[0012] Secondly, this application provides an industrial time-series data anomaly detection device, the device comprising: The data preprocessing module is configured to acquire the multivariate time series data to be detected and preprocess it to obtain a set of window sequences; wherein the multivariate time series data comes from industrial equipment sensors or network traffic monitoring systems. The multi-scale feature extraction module is configured to input the window sequences in the window sequence set into a dual-interactive temporal convolutional network to extract local temporal features and global temporal features respectively. The collaborative reconstruction module is configured to use a dual-structure autoencoder, which includes an adversarial reconstruction module and a U-shaped autoencoder, to reconstruct the local temporal features and the global temporal features, and obtain local reconstruction output and global reconstruction output. The model optimization module is configured to calculate the combined reconstruction loss based on the local reconstruction output, the global reconstruction output, and the original input, and to jointly optimize the model parameters of the dual-interactive temporal convolutional network and the dual-structure autoencoder based on the combined reconstruction loss. The anomaly detection module is configured to calculate the reconstruction error of each time window as an anomaly score based on the trained model, and adaptively determine the anomaly detection threshold based on the peak over-threshold method to identify anomalous data points.
[0013] Thirdly, embodiments of this application provide an electronic device, including: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, causing the at least one processor to perform the industrial time-series data anomaly detection method as described in the first aspect and various possible designs of the first aspect.
[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the industrial time-series data anomaly detection method described in the first aspect and various possible designs of the first aspect.
[0015] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the industrial time-series data anomaly detection method as described in the first aspect and various possible designs of the first aspect.
[0016] The industrial time-series data anomaly detection method, apparatus, equipment, and storage medium provided in this application have at least the following beneficial effects: (1) By designing a multi-scale feature extraction module that integrates bidirectional interactive temporal convolutional network (DITC), this method can simultaneously and collaboratively capture short-term sudden fluctuations (such as mechanical vibration spikes) and long-term performance degradation trends in industrial equipment sensor data. This solves the problem that traditional models cannot take into account both local details and global evolution patterns, and significantly enhances the model's ability to represent features of complex temporal dynamics.
[0017] (2) By introducing an adversarial reconstruction mechanism that includes a gradient reversal layer, this application effectively simulates and suppresses the interference of unknown anomalous samples in the training data on the modeling of normal patterns, forcing the encoder to learn feature representations robust to anomalous perturbations. This significantly improves the model's sensitivity to fine-grained anomalies that are difficult to reconstruct (such as early signs of equipment degradation or hidden security threats) and reduces the false negative rate of anomalies.
[0018] (3) By constructing a collaborative reconstruction architecture that combines self-feedback feature fusion and U-shaped autoencoder, this application achieves deep fusion and refined reconstruction of multi-level temporal features. The self-feedback mechanism strengthens the correction and supplementation of the original input by the local reconstruction results, while the U-shaped autoencoder, with its skip connection structure, effectively retains and integrates global context information across operating cycles. This not only improves the reconstruction accuracy of normal operating conditions or baseline flow, but also makes the reconstruction error at anomaly points more significant, thereby improving the distinguishability of anomaly detection.
[0019] (4) By adopting the peak over threshold (POT) method based on extreme value theory to adaptively determine the anomaly judgment threshold, this application can dynamically adjust the judgment criteria according to the tail characteristics of the actual data distribution. It has stronger robustness to common non-stationary noise and data distribution deviation in industrial environment, effectively reduces false alarms, and improves the overall stability and practicality of the detection system. Attached Figure Description
[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0021] Figure 1 This is a schematic diagram illustrating an application scenario of an industrial time-series data anomaly detection method provided in an embodiment of this application; Figure 2 A flowchart of an industrial time-series data anomaly detection method provided in this application embodiment; Figure 3 The structure diagram of the DITDA-Net model provided in the embodiments of this application; Figure 4 An architecture diagram of the adversarial reconfiguration module provided in an embodiment of this application; Figure 5 This is a flowchart of the DITDA-Net anomaly detection algorithm provided in an embodiment of this application; Figure 6 This is a structural diagram of the industrial time-series data anomaly detection device provided in an embodiment of this application.
[0022] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation
[0023] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0024] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0025] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.
[0026] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0027] This application provides a method for detecting anomalies in industrial time-series data, which can be applied to, for example... Figure 1 The application scenario shown includes a data acquisition module 101 and a data processor 102 connected by communication. The data acquisition module 101 can be a sensor network or network traffic monitoring system composed of several industrial equipment sensors, used to collect multivariate time series data. The collected multivariate time series data is transmitted to the data processor 102. The multivariate time series data consists of a sequence of real-valued vectors collected at fixed time intervals along a continuous time axis. Specifically, the sensor network can consist of vibration sensors, temperature sensors, pressure sensors, current sensors, and speed sensors deployed on key equipment. These sensors synchronously collect multidimensional physical quantities reflecting the operating status of the equipment at a fixed sampling frequency, forming a time series containing multi-channel measurement values. The network traffic monitoring system captures or listens to network node traffic, collecting multidimensional network behavior indicators in real time, such as source / destination IP address, port number, packet size, transmission protocol, traffic rate, and connection duration, and organizing them into a multivariate log sequence according to time sequence. The time-series data collected by sensor networks or network traffic monitoring systems are essentially structured data arranged in order by timestamps, with each time point corresponding to a multi-feature vector, which is the multivariate time-series data processed in this application.
[0028] In this embodiment, the definition of multivariate time series is as shown in Formula 1:
[0029] in Indicates the sequence length, for each observation. Both are m-dimensional vectors, that is, for ,have In particular, when When this happens, the sequence is called a univariate time series.
[0030] The goal of unsupervised multivariate time series anomaly detection is to identify unobserved data points. Is it abnormal? This task can be formulated as an autoregressive problem. Given a training time series... Model for the future The prediction of the test sequence at each time step can be expressed as follows:
[0031] Each of them This indicates whether the t-th timestamp in the predicted sequence is abnormal (1) or normal (0).
[0032] This embodiment employs a sliding window method to window the training set of time series data to enable prediction of subsequent steps. The size of the sliding window is set to a fixed value. A single-step prediction method is used, meaning that each time window only predicts the value of the last time step. Finally, the reconstruction loss is calculated based on the obtained prediction values.
[0033] Data processor 102, based on the multivariate time-series data fed by data acquisition module 101, performs operations such as... Figure 2 The flowchart of an industrial time-series data anomaly detection method shown includes the following steps S10-S50.
[0034] S10: Acquire the multivariate time series data to be detected and preprocess it to obtain a set of window sequences; wherein, the multivariate time series data comes from industrial equipment sensors or network traffic monitoring systems.
[0035] Before proceeding with further operations, a series of preprocessing operations are required on the input data. First, the input data is normalized to eliminate scale differences between variables. Then, the normalized data is divided into fixed-length time series windows for model training and evaluation. The normalization method used in this embodiment is as follows:
[0036] in and These are vectors containing the maximum and minimum values for each feature dimension in the training set. This is a small constant set to prevent division by zero. After this processing, the input data is converted to the range [0,1).
[0037] Next, to improve the model's generalization ability and robustness in real-world environments, this embodiment introduces white noise for data augmentation to simulate various interferences that may occur in actual scenarios. Specifically, white noise is injected into the original time series to maintain the overall signal-to-noise ratio (SNR) at 50 dB, thereby introducing a moderate disturbance while ensuring signal quality. The signal-to-noise ratio is an indicator that measures the relative intensity of signal energy compared to noise energy, and its calculation formula is as follows:
[0038] in This indicates the number of samples in the dataset. and These represent the normalized signal and white noise, respectively.
[0039] Subsequently, to capture the dependence of each point on its historical context, we employed a sliding window mechanism to segment the time series. Specifically, at each timestamp... t Define a fixed length at that location. τ The time window, and the corresponding segment, are represented as follows:
[0040] To maintain a constant window size, when In this case, a forward replication filling strategy is used to complete the missing historical data, thereby forming a complete time series window. Using this method, the original time series... Converted into a set of window sequences .
[0041] During training, these windowed sequences serve as input, enabling the model to learn the temporal characteristics of normal samples. During testing, the model reconstructs each test window and uses the reconstruction error as an anomaly score to identify anomalous observations.
[0042] This embodiment provides a DITDA-Net model, which takes step S10 and the processed data as input to execute subsequent steps S20 and S30. Specifically, the overall structure of DITDA-Net is as follows: Figure 3As shown, the model comprises two stages: In the first stage, the abnormal noise stream and the normal data stream are processed by a local interactive temporal convolutional module to extract local feature information. These data streams are then input into an encoder-dual decoder structure and undergo adversarial reconstruction via a gradient inversion layer, ultimately generating local feature reconstruction outputs and noise reconstruction outputs. In the second stage, the model fuses the local reconstruction outputs with the original inputs through a self-feedback feature fusion mechanism. The fused features are then passed through a global interactive temporal convolutional block to extract global feature information. Finally, a U-shaped autoencoder generates the global reconstruction output. The reconstruction errors of all three outputs are combined to calculate the final reconstruction loss.
[0043] S20: Input the window sequences in the window sequence set into the dual-interactive temporal convolutional network to extract local temporal features and global temporal features respectively.
[0044] The Dual Interactive Temporal Convolutional Network (DITC) proposed in this embodiment is as follows: Figure 3 As shown in (a), this dual-interaction temporal convolutional network includes a Local Interaction Temporal Convolution (LITC) module and a Global Interaction Temporal Convolution (GITC) module. By employing temporal convolutional units with different kernel sizes, it simultaneously captures local and global temporal dependencies, thereby enhancing the ability to represent multi-scale anomalies.
[0045] The LITC module primarily focuses on short-term dependencies. It employs causal convolution as the basic operation to preserve temporal causality and utilizes a two-layer structure: the first layer uses a dual-branch parallel structure with large-size causal convolutional kernels to extract local contextual features and enhances semantic extraction capabilities through an interaction mechanism—specifically, element-wise multiplication between the two branches allows each branch to fuse features from the other; the second layer uses causal convolutional blocks with small kernels to perform fine-grained processing on the fused output of the first layer. This step strengthens the module's ability to represent and recognize local temporal patterns. Therefore, given input... The processing procedure of the LITC module can be described as follows:
[0046] in and This represents causal convolutional blocks with different kernel sizes. This represents the GELU activation function. and These are the first and second intermediate features after the interaction. The final output of the LITC module is the local temporal feature. By and After addition, the result is fed into the second causal convolutional block. get:
[0047] The GITC module uses dilated convolution as its core operation to model long-range dependencies. This module first constructs a global context representation spanning a relatively long time span. This representation is then refined through an interactive structure to enhance the ability to extract global features. In the first layer, temporal convolutional kernels with large receptive fields cover the long time span, capturing global dependencies and broad semantic features. In the second layer, smaller convolutional kernels perform fine-grained interactive modeling of the first layer's output. This enhances the representation of local variations and improves sensitivity to local anomalies. The fused multi-scale features constitute the module's output. The calculation formula for the GITC module is as follows:
[0048] in , and This represents dilated convolutional blocks with different kernel sizes; B 1. B 2 and B 3 indicates an intermediate transition variable; O GITC It represents global temporal characteristics.
[0049] The DITC module enables cross-scale feature interactions through element-wise multiplication, thus modeling complex temporal patterns. This module employs customized network structures and dedicated convolutional units for different feature types, effectively capturing multi-scale temporal dependencies.
[0050] S30: Using a dual-structure autoencoder containing an adversarial reconstruction module and a U-shaped autoencoder, local and global temporal features are reconstructed to obtain local and global reconstruction outputs.
[0051] In reconstruction-based anomaly detection frameworks, the presence of anomalous noise often significantly interferes with the model training process, shifting the normal pattern distribution of time series data and weakening the encoder's ability to learn key feature representations. This interference not only affects the quality of latent feature representation but also further distorts the reconstruction results, ultimately reducing the accuracy and stability of anomaly detection. To mitigate the negative impact of anomalous noise on reconstruction learning, this embodiment introduces an adversarial learning mechanism, designing an Adversarial Reconstruction Module (ARM). This adversarial reconstruction module guides the model to focus more on the core feature representation of normal patterns through adversarial optimization strategies, improving the discriminative ability of reconstruction while suppressing anomalous interference, thereby significantly enhancing the model's anomaly recognition performance in complex noisy environments.
[0052] like Figure 4 As shown, this adversarial reconstruction module includes a Transformer encoder and two feedforward decoders, corresponding to the processing paths for normal and anomalous data, respectively. Normal data is processed through a standard decoder. Normal data is reconstructed using a normal data decoder, while anomalous data is reconstructed using an anomalous data decoder equipped with a gradient inversion layer (GRL). Perform adversarial restructuring.
[0053] The goal of this adversarial reconstruction module is to guide the encoder to learn representations robust to anomalous perturbations through adversarial optimization. Specifically, the model is trained to produce larger reconstruction errors for anomalous inputs while minimizing reconstruction errors for normal data. Parameters , and They are jointly optimized to suppress the impact of anomalies on representation learning and enhance the model's ability to capture normal patterns.
[0054] Local Reconstruction Loss: Treating the output of the normal decoder as the local reconstruction output of the model, the mean squared error loss of local information reconstruction is derived and defined as:
[0055] in L Local This represents the local reconstruction loss. This represents the i-th normal observation. n Indicates the number of normal observations. This represents the corresponding normal input window. , and These represent the decoder's built-in parameters. E 'D' represents the encoder, and 'D' represents the decoder.
[0056] Gradient Reversal Mechanism: Gradient Reversal Layer (GRL) was developed by Ganin et al.
[56] The proposed approach is a parameterless module that facilitates adversarial optimization. It performs an identity mapping (y = x) during forward propagation and reverses the gradient during backpropagation. This operation can be expressed as:
[0057] in It is the gradient flowing from the self-decoder to the gradient inversion layer (GRL). It is the inverse gradient that is passed back to the encoder. Control the inversion strength. This mechanism is used by the abnormal data decoder. The loss is scaled during backpropagation. This effectively suppresses the influence of anomalous features and enhances encoder robustness.
[0058] Anomaly Generation and Adversarial Loss: To construct the anomalous data stream required for adversarial training, we inject Gaussian noise into normal samples to simulate anomalous behavior. Given normal input or normal data... The formula for generating abnormal data is:
[0059] in It is a noise vector sampled from a standard Gaussian distribution. This is a parameter that controls the intensity of the disturbance. After noise is injected, the anomalous data is segmented into a window sequence using the same sliding strategy. The reconstruction loss of anomalous data is then defined as:
[0060] in L A Indicating resistance to loss, and express i Abnormal inputs and outputs at all times Decoder for abnormal data 。
[0061] During backpropagation, this loss is propagated backward through a gradient inversion layer (GRL) to achieve adversarial learning. The final adversarial loss can be expressed as:
[0062] in L Rev It signifies resistance to loss.
[0063] Traditional deep encoders often neglect or lose fine-grained details in the shallow layers of the input sequence when extracting high-level abstract features. In contrast, single-layer encoders can preserve local structure but lack sufficient ability to model complex nonlinear dependencies. To address these limitations, this embodiment proposes a U-shaped autoencoder (UAE) module, such as... Figure 3 As shown in (c), the UAE module enhances reconstruction capabilities through a hierarchical design and achieves effective modeling of multi-scale temporal features. This architecture consists of a multi-layer symmetric encoder and decoder. The encoder employs a hierarchical compression strategy, with each layer performing a nonlinear mapping on the output of the previous layer, progressively extracting temporal features from shallow to deep layers. The encoder input is defined as:
[0064] in and These are the inputs to the i-th and (i-1)-th layers of the encoder. The module's output,L This represents the total number of encoder layers. The output of each encoder layer is given by the following formula:
[0065] in This represents the i-th encoder layer. Here, the Transformer encoder as defined in the above embodiment is used.
[0066] The decoder employs a hierarchical structure symmetrical to the encoder, progressively reconstructing the multi-scale features extracted by the encoder. Each decoding layer receives the output of the previous decoder layer and integrates skip connections from the corresponding encoder layer. This combination allows shallow local features to supplement deep global features during reconstruction. This design supports collaborative reconstruction: deep semantic information models the global structure, while residual connections preserve shallow details lost during downsampling. The decoder input can be represented as:
[0067] in and These represent the input and output of the i-th layer of the decoder, respectively.
[0068] The decoder output can be represented as:
[0069] in This represents the i-th decoder layer. The final module output... The reconstruction result after global feature extraction is represented as the global reconstruction output. Accordingly, the global reconstruction loss based on mean squared error is defined as:
[0070] in L Global This represents the global reconstruction loss.
[0071] S40: Based on the local reconstruction output, global reconstruction output, and original input, calculate the combined reconstruction loss, and jointly optimize the model parameters of the dual-interactive temporal convolutional network and the dual-structure autoencoder based on the combined reconstruction loss.
[0072] S50: Calculate the reconstruction error of each time window as an anomaly score based on the trained model, and adaptively determine the anomaly judgment threshold based on the peak over-threshold method to identify abnormal data points.
[0073] This embodiment uses the Peak Over Threshold (POT) method.
[57] This method adaptively determines anomaly score thresholds based on reconstruction loss. By modeling the tail region of the probability distribution, it effectively characterizes the statistical properties of extreme values. Specifically, the POT method assumes that when an observation exceeds a certain high threshold, the distribution of the excess portion can be approximated by the Generalized Pareto Distribution (GPD). GPD is widely used in extreme value theory to describe the decay pattern of the tail of random variables and can flexibly adapt to different types of data distribution characteristics. By parametrically modeling the tail distribution, GPD can characterize the changing trend of anomaly scores in the high-value region, thus providing a more reasonable boundary between anomalies and normal samples. Compared with fixed threshold methods, the GPD-based POT method can dynamically adjust the threshold according to the actual situation of the data distribution, exhibiting stronger adaptability to noise and distribution shifts. This threshold estimation method based on tail statistical properties makes the anomaly detection process more robust in complex and non-stationary scenarios, effectively reducing false positives and false negatives.
[0074] The experiment followed the standard POT (Point of Interest) procedure, focusing on analyzing upper quantiles to detect key events. For a multivariate time series S, its GPD function expression is:
[0075] in Initial anomaly score threshold s , This represents the extreme values that exceed the threshold, and these extreme values follow the parameter . and The generalized Pareto distribution, This is the symbolic representation of the distribution function.
[0076] parameter and The final threshold is obtained through maximum likelihood estimation (MLE). The calculation formula is:
[0077] in This represents the probability of a target exceeding a threshold. It is the total number of observations. Peak value China satisfies The quantity.
[0078] During training, the ultimate goal of the model is to adjust the hyperparameters. This parameter is used to balance the contributions of local and global reconstruction to jointly optimize the two modules. By combining three reconstruction-related loss functions in a weighted manner, the joint optimization objective can be expressed as:
[0079] in L T For the combined reconstruction loss, L Local This represents the local reconstruction loss. L Global Indicates the global reconstruction loss. L Rev It signifies resistance to loss.
[0080] To provide a more detailed description, Algorithm 1 provides a detailed explanation of the implementation logic of the DITDA-Net model. For example... Figure 5 The diagram illustrates the algorithmic process of anomaly detection using the DITDA-Net model. The input to this algorithm is multivariate time series data. Output exception labels Specifically, for Perform the following steps: Step 1, generate abnormal data: ; Step 2, divide the window: , ; Step 3, calculate the local reconstruction output: , ; Step 4, calculate the anomaly reconstruction output: , ; Step 5, calculate the global reconstruction output: , ; Step 6: Calculate the loss according to Formula 26 and minimize loss ; Step 7: Calculate the anomaly score and threshold according to formulas 24 and 25 to determine anomalies; Step 8, return the exception label .
[0081] This application also provides an industrial time-series data anomaly detection device, used to implement the methods described in any of the above embodiments, such as... Figure 6 As shown, the industrial time-series data anomaly detection device includes: The data preprocessing module 601 is configured to acquire the multivariate time series data to be detected and perform preprocessing to obtain a set of window sequences; wherein the multivariate time series data comes from industrial equipment sensors or network traffic monitoring systems. The multi-scale feature extraction module 602 is configured to input the window sequence in the window sequence set into a dual-interactive temporal convolutional network to extract local temporal features and global temporal features respectively. The collaborative reconstruction module 603 is configured to use a dual-structure autoencoder, which includes an adversarial reconstruction module and a U-shaped autoencoder, to reconstruct the local temporal features and the global temporal features, and obtain local reconstruction output and global reconstruction output. The model optimization module 604 is configured to calculate the combined reconstruction loss based on the local reconstruction output, the global reconstruction output, and the original input, and to jointly optimize the model parameters of the dual-interactive temporal convolutional network and the dual-structure autoencoder based on the combined reconstruction loss. The anomaly detection module 605 is configured to calculate the reconstruction error of each time window as an anomaly score based on the trained model, and adaptively determine the anomaly detection threshold based on the peak over threshold method to identify anomalous data points.
[0082] This application provides an electronic device. The electronic device may include a processor and a memory, wherein the processor and the memory can communicate; exemplarily, the processor and the memory communicate via a communication bus.
[0083] The processor executes computer execution instructions stored in memory, causing the processor to perform the scheme in the above embodiments. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0084] The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. Transceivers are used to enable communication between database access devices and other computers (e.g., clients, read-write libraries, and read-only libraries). Memory may include random access memory (RAM) and may also include non-volatile memory.
[0085] The electronic device provided in this application embodiment can be the terminal device described in the above embodiments.
[0086] This application also provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer performs the technical solution of the industrial time-series data anomaly detection method described above.
[0087] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When the at least one processor executes the computer program, it can implement the technical solution of the industrial time-series data anomaly detection method in the above embodiments.
[0088] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.
[0089] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.
[0090] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.
[0091] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.
[0092] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.
[0093] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.
[0094] Buses can be Industry Standard Architecture (ISA) buses, Peripheral Component Interconnect (PCI) buses, or Extended Industry Standard Architecture (EISA) buses, etc. Buses can be categorized into address buses, data buses, control buses, etc.
[0095] The aforementioned storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.
[0096] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. The processor and storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic control unit or main control device.
[0097] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.
[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.
Claims
1. An industrial time series data anomaly detection method, characterized in that, The method includes: The multivariate time series data to be detected is acquired and preprocessed to obtain a set of window sequences; wherein the multivariate time series data comes from industrial equipment sensors or network traffic monitoring systems. The window sequences in the set of window sequences are input into a dual-interactive temporal convolutional network to extract local temporal features and global temporal features, respectively. A dual-structure autoencoder, including an adversarial reconstruction module and a U-shaped autoencoder, is used to reconstruct the local temporal features and global temporal features to obtain local reconstruction output and global reconstruction output. Based on the local reconstruction output, global reconstruction output, and original input, the combined reconstruction loss is calculated, and the model parameters of the dual-interactive temporal convolutional network and the dual-structure autoencoder are jointly optimized based on the combined reconstruction loss. The reconstruction error of each time window is calculated as an anomaly score based on the trained model, and the anomaly judgment threshold is adaptively determined based on the peak over threshold method to identify abnormal data points.
2. The industrial time-series data anomaly detection method according to claim 1, characterized in that, The multivariate time series data to be detected is acquired and preprocessed to obtain a window sequence set, including: The multivariate time series data is normalized using the following formula to obtain the normalized signal: （3） in The signal is normalized; and It is a vector containing the maximum and minimum values of each feature dimension in the training set; It is a small constant set to prevent division by zero; X It is a multivariate time series; These are observations in a multivariate time series; Data enhancement is performed on the normalized signal by injecting white noise to maintain the overall signal-to-noise ratio at a preset value; the formula for calculating the signal-to-noise ratio is: （4） in SNR For signal-to-noise ratio, t For a moment, N Indicates the number of samples in the dataset; It is white noise; The formula for calculating data augmentation is: （5） A sliding window mechanism is used to segment the enhanced time series into a set of window sequences of fixed length; wherein, at each timestamp t Define a fixed length at that location. τ The time window, and the corresponding segment, are represented as follows: （6） in W t Represents timestamp t The window sequence at that location, x t-τ+1 , x t-τ+2 , x t-τ These represent observations at different timestamps. R Let m represent the set of real numbers. Dimensions.
3. The industrial time-series data anomaly detection method according to claim 1, characterized in that, The dual-interactive temporal convolutional network includes a local interactive temporal convolutional module and a global interactive temporal convolutional module; The local interactive temporal convolution module is used to extract short-term dependencies, and its processing includes: processing the input window sequence... W t Feature extraction and interaction are performed through bi-branch causal convolutions with different kernel sizes: （7） （8） in and This represents causal convolutional blocks with different kernel sizes. Represents the GELU activation function. and These are the first and second intermediate features after the interaction; The first and second intermediate features after the interaction are summed and passed through a second causal convolutional block to obtain local temporal features. O LITC ; The global interactive temporal convolution module calculates the global temporal features using the following formula: （10） （11） （12） （13） in , and This represents dilated convolutional blocks with different kernel sizes; B 1. B 2 and B 3 indicates an intermediate transition variable; O GITC It represents global temporal characteristics.
4. The industrial time-series data anomaly detection method according to claim 1, characterized in that, The dual-structure autoencoder includes an adversarial reconstruction module and a U-shaped autoencoder; The adversarial reconstruction module includes an encoder, a normal data decoder, and an abnormal data decoder equipped with a gradient inversion layer. The normal data stream is reconstructed by the encoder and normal data decoder to produce a partially reconstructed output. The local reconstruction loss is defined as: （14） in L Local This represents the local reconstruction loss. Indicates the first i A normal observation value, n Indicates the number of normal observations. This represents the corresponding normal input window. Represents a normal data decoder. and These represent the decoder's built-in parameters. E Indicates encoder; The gradient inversion layer inverts the gradient during backpropagation, as described in the following operation: （15） in It is the gradient flowing from the self-decoder to the gradient inversion layer. It is the inverse gradient that is passed back to the encoder. It is a parameter that controls the intensity of the reversal; L Indicates the number of layers in the encoder; Abnormal data is generated by injecting Gaussian noise into normal data. x A : （16） in It is a noise vector sampled from a standard Gaussian distribution. It is a parameter that controls the intensity of the disturbance. This is normal data; The abnormal data is reconstructed adversarially using the encoder and the abnormal data decoder, wherein the reconstruction loss of the abnormal data is defined as: （17） in L A This represents the reconstruction loss of anomalous data. and express i Abnormal inputs and outputs at all times This indicates an abnormal data decoder. This indicates a decoder exception built-in parameter. express i Time-based abnormal sequences; During backpropagation, the reconstruction loss of anomalous data is propagated backward through the gradient reversal layer to achieve adversarial learning. The final adversarial loss is expressed as: （18） in L Rev It signifies resistance to loss.
5. The industrial time-series data anomaly detection method according to claim 4, characterized in that, The U-shaped autoencoder consists of a multi-layer symmetrical encoder and a decoder; wherein, the encoder adopts a layered compression strategy, and each layer performs nonlinear mapping on the output of the previous layer, gradually extracting time features from shallow to deep layers. The input of the encoder is represented as follows: （19） in and These are the inputs to the i-th and (i-1)-th layers of the encoder. It is the output of the global interactive convolution module. L This represents the total number of encoder layers; The output of each encoder layer is given by the following formula: （20） in It is the output of the i-th layer of the encoder. This represents the i-th encoder layer; The decoder adopts a hierarchical structure symmetrical to the encoder, and gradually reconstructs the multi-scale features extracted by the encoder. Each decoding layer receives the output of the previous decoder layer and integrates the skip connections from the corresponding encoder layer. The input to the decoder is represented as follows: （21） in and These represent the input and output of the i-th layer of the decoder, respectively. FFN Indicates feedforward layer; The output of the decoder is represented as follows: （22） in This represents the i-th decoder layer; The output of the U-shaped self-encoder As the output of global reconstruction, its global reconstruction loss is defined as: （23） in L Global Indicates the global reconstruction loss; This represents the output of the global interactive convolutional block. express i The reconstruction result after global feature extraction at any time step.
6. The industrial time-series data anomaly detection method according to claim 1, characterized in that, The reconstruction error for each time window is calculated as an anomaly score based on the trained model, and an anomaly determination threshold is adaptively determined based on the peak exceedance method to identify anomalous data points, including: The reconstruction error is used as the outlier score, and the generalized Pareto distribution is used to identify outliers exceeding the initial outlier score threshold. Model the extreme value part: （24） in This represents the extreme value exceeding the threshold. s The extreme value follows the parameter: and The generalized Pareto distribution, S Indicates an abnormal sequence; Final anomaly detection threshold The calculation formula is: （25） in This represents the probability of a target exceeding a threshold. It is the total number of observations. Peak value China satisfies Quantity, parameters and It is obtained through the maximum likelihood estimation method; Will exceed the final anomaly determination threshold The data points were identified as abnormal data points.
7. The industrial time-series data anomaly detection method according to claim 1, characterized in that, The combined reconstruction loss is expressed as: （26） in L T For the combined reconstruction loss, Indicates hyperparameters, L Local This represents the local reconstruction loss. L Global Indicates the global reconstruction loss. L Rev It signifies resistance to loss.
8. An industrial time-series data anomaly detection device, characterized in that, The device includes: The data preprocessing module is configured to acquire the multivariate time series data to be detected and preprocess it to obtain a set of window sequences; wherein the multivariate time series data comes from industrial equipment sensors or network traffic monitoring systems. The multi-scale feature extraction module is configured to input the window sequences in the window sequence set into a dual-interactive temporal convolutional network to extract local temporal features and global temporal features respectively. The collaborative reconstruction module is configured to use a dual-structure autoencoder, which includes an adversarial reconstruction module and a U-shaped autoencoder, to reconstruct the local temporal features and the global temporal features, and obtain local reconstruction output and global reconstruction output. The model optimization module is configured to calculate the combined reconstruction loss based on the local reconstruction output, the global reconstruction output, and the original input, and to jointly optimize the model parameters of the dual-interactive temporal convolutional network and the dual-structure autoencoder based on the combined reconstruction loss. The anomaly detection module is configured to calculate the reconstruction error of each time window as an anomaly score based on the trained model, and adaptively determine the anomaly detection threshold based on the peak over-threshold method to identify anomalous data points.
9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the industrial time-series data anomaly detection method as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the industrial time-series data anomaly detection method as described in any one of claims 1-7.