Anomaly detection method and system combining uncertainty modeling and anomaly perception calibration

Abstract

The present application relates to the technical field of industrial data processing, in particular to an anomaly detection method and system combining uncertainty modeling and abnormal perception calibration. The method comprises: obtaining online monitoring sequence data of a target system, inputting the online monitoring sequence data into a pre-trained basic anomaly detection model, outputting corresponding preliminary anomaly scores and reconstruction residuals, and performing uncertainty estimation on the inference process of the basic anomaly detection model. The present application also discloses a corresponding system. The present application fuses the context features of online monitoring data, reconstruction residuals and uncertainty measurement values of model inference by self-attention weighting to construct a calibration feature set, recalibrates the preliminary anomaly scores by combining the distribution deviation index calculated by the historical data sliding window, and dynamically adjusts the baseline threshold, so that stable detection performance and a dynamic threshold with high interpretability can be maintained in the concept drift and context change stage.

Description

Technical Field

[0001] This invention relates to the field of industrial data processing technology, and in particular to an anomaly detection method and system that combines uncertainty modeling and anomaly perception calibration. Background Technology

[0002] With the integration and development of industrial IoT and artificial intelligence technologies, anomaly detection technology based on online monitoring sequence data plays a key role in equipment status monitoring and predictive maintenance. However, in actual production scenarios, industrial equipment is usually in a complex and ever-changing external environment and alternating operating conditions. The underlying distribution of its monitoring data often changes gradually or abruptly over time as the equipment operates for a long period of time or the process is adjusted, resulting in contextual changes and concept drift.

[0003] Most existing anomaly detection methods rely on a single reconstruction error feature and use a static and fixed judgment threshold. They lack comprehensive consideration of model inference confidence and deviation of historical data distribution. When faced with equipment operating condition switching and data concept drift, they are unable to adaptively perceive dynamic changes in data and smooth out environmental disturbances. As a result, they cannot effectively recalibrate anomaly scores and dynamically adjust the baseline threshold during context change phases, making it difficult to maintain stable and reliable detection performance. Summary of the Invention

[0004] To overcome the above shortcomings, this invention provides an anomaly detection method and system that combines uncertainty modeling and anomaly perception calibration. It aims to improve the problem that most existing anomaly detection methods rely on a single reconstruction error feature and use a static and fixed judgment threshold, lacking a comprehensive consideration of model inference confidence and historical data distribution deviation.

[0005] In a first aspect, the present invention provides an anomaly detection method that combines uncertainty modeling and anomaly perception calibration, comprising the following steps: S100 acquires online monitoring sequence data of the target system, inputs the online monitoring sequence data into a pre-trained basic anomaly detection model, and outputs the corresponding preliminary anomaly score and reconstruction residual; S200 performs uncertainty estimation on the reasoning process of the basic anomaly detection model and calculates a statistical index for the preliminary anomaly score as an uncertainty measure. S300 extracts the time and operating status information corresponding to the online monitoring sequence data as context features, and fuses the context features, the reconstruction residual, and the uncertainty metric to construct a calibration feature set; S400 performs a recalibration operation on the preliminary anomaly score based on the calibration feature set, calculates the dynamic threshold corresponding to the current online monitoring sequence data, and outputs the calibrated anomaly score and the dynamic threshold. S500 compares the calibrated anomaly score with the dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, it determines that the current online monitoring sequence data is abnormal and outputs the target anomaly detection result.

[0006] Preferably, in step S100, the step of inputting the online monitoring sequence data into a pre-trained basic anomaly detection model and outputting the corresponding preliminary anomaly score and reconstruction residual specifically includes the following steps: S101 uses a pre-set autoencoder network to perform latent space encoding and decoding reconstruction on the online monitoring sequence data to generate reconstructed sequence data; S102 calculates the difference between the online monitoring sequence data and the reconstructed sequence data at corresponding time values, and generates the reconstruction residual; S103 calculates the distance norm of the reconstructed residual and uses the distance norm as a preliminary anomaly score.

[0007] Preferably, in step S200, the uncertainty estimation of the inference process of the basic anomaly detection model and the calculation of a statistical index for the preliminary anomaly score as an uncertainty measure specifically include the following steps: S201 performs independent perturbation inference on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores; S202 calculates the statistical dispersion of the prediction set and uses the statistical dispersion as a statistical indicator.

[0008] Preferably, the step of performing independent perturbation inference on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores specifically includes: S211 activates the Monte Carlo random deactivation mechanism in the neural network layer of the basic anomaly detection model; S212 performs independent forward propagation inference on the same online monitoring sequence data to generate a prediction set; Preferably, in S3, the step of extracting the time and operating status information corresponding to the online monitoring sequence data as context features, and fusing the context features, the reconstructed residuals, and the uncertainty metric to construct a calibration feature set, specifically includes the following steps: S301 Extracts the timestamp period identifier and system load level index of the online monitoring sequence data, and converts the timestamp period identifier and the system load level index into a continuous context feature representation; S302 maps the context feature representation, the reconstruction residual, and the uncertainty metric value into feature representation vectors of the same dimension; S303 performs weighted summation and fusion on the feature representation vectors to generate a calibration feature set.

[0009] Preferably, the step of weighted summation and fusion of the feature representation vectors to generate a calibration feature set specifically includes: S331 uses a self-attention mechanism to calculate the attention score between the feature representation vectors; S332 performs a weighted summation and fusion of the feature representation vectors based on the attention scores to generate a calibration feature set.

[0010] Preferably, in S4, the step of recalibrating the preliminary anomaly score based on the calibration feature set, calculating the dynamic threshold corresponding to the current online monitoring sequence data, and outputting the calibrated anomaly score and the dynamic threshold specifically includes the following steps: S401 maintains a sliding window that stores a set of historical calibration features; S402 calculates the distribution deviation index of the calibration feature set relative to the distribution of historical calibration feature sets within the sliding window; S403 performs a recalibration operation on the preliminary anomaly score based on the value of the distribution deviation index, calculates the dynamic threshold corresponding to the current online monitoring sequence data, and outputs the calibrated anomaly score and the dynamic threshold.

[0011] Preferably, the step of recalibrating the initial anomaly score based on the value of the distribution deviation index, calculating a dynamic threshold, and outputting the calibrated anomaly score and the dynamic threshold specifically includes: S431 calculates the adjustment weight of the preliminary anomaly score and the adjustment ratio of the calculation threshold based on the value of the distribution deviation index. S432 multiplies the preliminary anomaly score by the adjusted weight to obtain the calibrated anomaly score; S433 obtains a static baseline threshold set based on historical normal data, adds a threshold offset generated based on the adjustment ratio to the static baseline threshold, and generates the dynamic threshold.

[0012] Preferably, in step S5, comparing the calibrated anomaly score with the dynamic threshold, and if the calibrated anomaly score exceeds the dynamic threshold, determining that the current online monitoring sequence data is abnormal and outputting the target anomaly detection result, specifically includes the following steps: S501 compares the calibrated anomaly score with the value of the dynamic threshold; S502 When the calibrated anomaly score is greater than the dynamic threshold, an alarm signal containing a timestamp and the severity of the anomaly is generated as the target anomaly detection result. S503 marks the online monitoring sequence data that triggered the alarm signal as a concept drift candidate sample and stores it in the dynamic sample library.

[0013] Secondly, the present invention provides an anomaly detection system that combines uncertainty modeling and anomaly perception calibration, the system comprising: The basic anomaly detection module is used to acquire online monitoring sequence data of the target system, input the online monitoring sequence data into the pre-trained basic anomaly detection model, and output the corresponding preliminary anomaly score and reconstruction residual. The uncertainty estimation module is used to estimate the uncertainty of the reasoning process of the basic anomaly detection model and calculate the statistical index for the preliminary anomaly score as an uncertainty measure. The calibration feature construction module is used to extract the time and operating status information corresponding to the online monitoring sequence data as context features, and to fuse the context features, the reconstruction residuals, and the uncertainty measure values ​​to construct a calibration feature set. The dynamic calibration module is used to perform recalibration operation on the preliminary anomaly score based on the calibration feature set, calculate the dynamic threshold corresponding to the current online monitoring sequence data, and output the calibrated anomaly score and the dynamic threshold. The anomaly detection module is used to compare the calibrated anomaly score with the dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, the current online monitoring sequence data is determined to be abnormal, and the target anomaly detection result is output.

[0014] In summary, the technical solutions conceived by this invention have the following beneficial effects compared with the prior art: (1) In this invention, the context features of online monitoring data, reconstruction residuals and uncertainty measures of model inference are self-attention weighted to construct a calibration feature set. Then, the distribution deviation index is calculated by combining historical data sliding window to recalibrate the preliminary abnormal score and dynamically adjust the benchmark threshold. This enables the detection system to adaptively perceive and smooth out working condition switching and environmental disturbances, so that it can maintain stable detection performance and highly interpretable dynamic thresholds during concept drift and context change stages.

[0015] (2) In this invention, by introducing a random deactivation mask mechanism that follows the Bernoulli distribution into the multi-layer fully connected network of the basic anomaly detection model, multiple independent forward propagation inferences are performed on the same input feature to generate a prediction set containing multiple preliminary anomaly scores, and the statistical prediction variance of the set is used as an uncertainty measure to characterize the confidence of the model. The random perturbation of the structure of the hidden layer of the neural network is cleverly transformed into specific data that quantifies the state fluctuation of physical equipment, providing an evaluation dimension with rigorous mathematical logic support for subsequent multi-source feature fusion and dynamic baseline adjustment.

[0016] (3) In this invention, by comparing the abnormal score after recalibration with a dynamic threshold that is strictly greater than zero, when the score exceeds the limit, the abnormal severity of the critical fault state is calculated based on the over-limit amplitude and a digital alarm signal is output in combination with the physical timestamp. At the same time, the underlying multidimensional state feature vector that triggers the alarm is automatically marked as a concept drift candidate sample and stored in the dynamic sample library. This not only realizes the accurate quantification and real-time interception of abnormal equipment conditions, but also accumulates a high-quality real variation data source for the subsequent automated iteration of the detection model and the continuous learning of the physical environment characteristics of the system. Attached Figure Description

[0017] Figure 1 This is a flowchart of an anomaly detection method combining uncertainty modeling and anomaly perception calibration proposed in one embodiment of the present invention; Figure 2 This is an architecture diagram of an anomaly detection system that combines uncertainty modeling and anomaly perception calibration, as proposed in one embodiment of the present invention. Detailed Implementation

[0018] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: In a first embodiment of the present invention, the present invention provides an anomaly detection method that combines uncertainty modeling and anomaly perception calibration, such as... Figure 1 As shown, it includes the following steps: Step S100: Obtain online monitoring sequence data of the target system, input the online monitoring sequence data into the pre-trained basic anomaly detection model, and output the corresponding preliminary anomaly score and reconstruction residual.

[0020] Specifically, in S1, the online monitoring sequence data is input into the pre-trained basic anomaly detection model, and the corresponding preliminary anomaly score and reconstruction residual are output. This includes the following steps: S101 uses a pre-built autoencoder network to perform latent space encoding and decoding reconstruction on online monitoring sequence data to generate reconstructed sequence data; S102 calculates the difference between the corresponding time values ​​of the online monitoring sequence data and the reconstructed sequence data, and generates the reconstruction residual; S103 calculates the distance norm of the reconstructed residuals and uses the distance norm as the initial anomaly score.

[0021] In this specific embodiment, the online monitoring sequence data of the target system is first acquired. Taking an industrial production equipment operation monitoring system as an example, the acquired online monitoring sequence data consists of multi-dimensional physical state measurements continuously collected by sensors, specifically covering the time series signals of equipment operating temperature, pipeline pressure, and rotor vibration frequency. The acquired online monitoring sequence data is set as... ,in Indicates industrial equipment in the first Multidimensional state feature vectors at each time step This indicates the time window step size for the sequence data.

[0022] Online monitoring sequence data is input into a pre-trained basic anomaly detection model. To pre-train the model, a training set is constructed by collecting normal multi-dimensional state feature vectors of the target industrial equipment operating under historical health conditions. The training set is set as follows: ,in Indicates the first A normal multidimensional state feature vector, This represents the total number of training samples. The basic anomaly detection model employs an autoencoder network architecture, specifically instantiated as a multilayer perceptron network. During the training phase, mean squared error is used as the loss function to guide network optimization; the specific formula for calculating the training loss function is as follows: ; in Represents the training loss function. and These represent the parameters of the network model respectively. and The encoder and decoder mapping network functions are constructed using a nonlinear mapping network function. The network model parameters are continuously updated using the backpropagation algorithm and gradient descent optimizer. and To minimize the training loss function This continues until the network converges, resulting in a pre-trained basic anomaly detection model.

[0023] Preferably, a pre-built autoencoder network is used to perform latent space encoding and decoding reconstruction on the online monitoring sequence data to generate reconstructed sequence data. For any given time step... The calculation formula for the encoding process is as follows: ; in For the generated first The low-dimensional latent space encoded feature vector is obtained at each time step. This low-dimensional latent space encoded feature vector is then restored to the original multi-dimensional physical state measurement dimension. The calculation formula for the decoding and reconstruction process is as follows: ; in Indicates the first The reconstructed state feature vectors at each time step, and the outputs of each time step together form the reconstructed sequence data. .

[0024] Preferably, the difference between the values ​​at corresponding time points in the online monitoring sequence data and the reconstructed sequence data is calculated to generate a reconstruction residual. For each time step, the numerical difference between the original multidimensional state feature vector and the reconstructed state feature vector is calculated, and the residual calculation formula is as follows: ; in Indicates the first The multidimensional reconstructed residual vector is calculated at each time step. The distance norm of the reconstructed residual is then used as the initial anomaly score. The specific calculation formula is as follows: ; in Indicates the target device in the 1st century. The preliminary anomaly score corresponds to each time step. This represents the Euclidean norm of the multidimensional reconstructed residual vector, used to measure the distance in the feature space.

[0025] In this embodiment, the multidimensional physical monitoring signal is converted into a scalar score through the above steps, providing a benchmark quantification basis for subsequent anomaly determination.

[0026] Step S200: Estimate the uncertainty of the reasoning process of the basic anomaly detection model and calculate the statistical index for the preliminary anomaly score as the uncertainty measure.

[0027] Specifically, in step S200 of this embodiment, uncertainty estimation is performed on the inference process of the basic anomaly detection model, and a statistical index for the preliminary anomaly score is calculated as an uncertainty measure. This specifically includes the following steps: S201 performs independent perturbation inference on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores; S202 calculates the statistical dispersion of the prediction set and uses the statistical dispersion as a statistical indicator.

[0028] Optionally, in step S201, independent perturbation inference is performed on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores, specifically including: S211 activates the Monte Carlo random deactivation mechanism in the neural network layer of the basic anomaly detection model; S212 performs independent forward propagation inference on the same online monitoring sequence data to generate a prediction set. Specifically, uncertainty estimation is performed on the inference process of the basic anomaly detection model. The aforementioned pre-trained basic anomaly detection model is instantiated as a multilayer perceptron architecture containing multiple fully connected network layers. A Monte Carlo random deactivation mechanism is activated in the fully connected network layers of the basic anomaly detection model. Specifically, the total number of hidden layers is set to... For any hidden layer We introduce a random mask variable following a Bernoulli distribution to represent the disconnected connection state of network neurons. Let the preset inactivation probability be... Then in the first In the independent forward propagation reasoning, the first Layer The random mask state elements of each neuron follow a probability distribution, calculated using the following formula: ; in Indicates the first second reasoning Layer The masking state of each neuron and The value ranges from one to the total number of neurons in that layer. Represents probability operations. This represents the probability that a neuron maintains its active connection, thereby constructing a basic anomaly detection model with hierarchical random perturbation characteristics at the algorithm level.

[0029] Optionally, independent perturbation inference is performed on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores. For the aforementioned industrial equipment... Multidimensional state feature vector at each time step This is then fed into the underlying anomaly detection model with the Monte Carlo random deactivation mechanism activated for independent forward propagation inference. The total number of independent inferences is set to... In the In this inference process, the initial input layer features of the model are defined. Equal to multidimensional state feature vector The formula for the feature forward propagation algorithm of the hidden layer is as follows: ; in Indicates the first The hidden feature vector output by the layer. This represents the hidden feature vector passed from the previous layer. This represents a random mask vector composed of the aforementioned mask state elements. This represents the Hadamard product operation. Represents a non-linear activation function. and They represent the first The network weight matrix and bias vector of the last layer. The model is defined as the last layer, i.e., the [number]th layer. Layer output features For the first Secondary reconstruction of state feature vector Based on the original multidimensional state feature vector With the Secondary reconstruction of state feature vector Calculate the distance values ​​in the multidimensional feature space to obtain the first... The initial anomaly score is calculated using the following formula: ; in Indicates the first The initial anomaly score for this industrial equipment was obtained from the first independent forward propagation. This represents the Euclidean L2 norm operation. After all the independent inferences are set, the preliminary anomaly scores obtained from each calculation are aggregated to generate a prediction set, which is represented as... .

[0030] Optionally, the statistical dispersion of the prediction set is calculated and used as a statistical indicator. The prediction variance of the prediction set is used as this statistical dispersion. The mean of all preliminary outlier scores in the prediction set is calculated using the following formula: ; in This represents the mean of the initial anomaly scores of the current multidimensional state feature vector of industrial equipment under random network connection inference. The prediction variance of the prediction set is calculated based on this mean initial anomaly score, using the following formula: ; in This represents the calculated prediction variance, quantifying the magnitude of fluctuation in the assessment results of the basic anomaly detection model regarding the current physical condition of industrial equipment. This prediction variance... This serves as a statistical indicator for the initial anomaly score, and is output as a measure of the uncertainty of the industrial equipment at the current time step.

[0031] In this embodiment, the structural randomness of the hidden layer of the artificial intelligence model is transformed into the data fluctuation variance of the equipment status judgment result through the above steps, which quantifies the confidence level of the model's inference on the current industrial equipment monitoring data and provides quantitative input for the subsequent calibration of abnormal scores.

[0032] Step S300: Extract the time and operating status information corresponding to the online monitoring sequence data as context features, and fuse the context features, reconstruction residuals, and uncertainty measures to construct a calibration feature set.

[0033] In step S300 of this embodiment, as a preferred solution, firstly, the time and operating status information corresponding to the online monitoring sequence data are extracted as context features, and the context features, reconstruction residuals, and uncertainty measures are fused to construct a calibration feature set, specifically including the following steps: S301 extracts the timestamp period identifier and system load level index from the online monitoring sequence data, and converts the timestamp period identifier and system load level index into a continuous context feature representation; S302 maps the context feature representation, reconstruction residual, and uncertainty metric to feature representation vectors of the same dimension; S303 performs weighted summation and fusion of feature representation vectors to generate a calibration feature set.

[0034] Specifically, in a preferred embodiment, step S303 involves weighted summation and fusion of the feature representation vectors to generate a calibration feature set, which may specifically include: S331 uses a self-attention mechanism to calculate the attention score between feature representation vectors; S332 performs weighted summation and fusion of feature representation vectors based on attention scores to generate a calibration feature set.

[0035] Specifically, the time and operating status information corresponding to the online monitoring sequence data are extracted as contextual features. This is for industrial equipment in the [specific context - likely referring to a specific stage or phase]. The online monitoring sequence data at each time step is used to extract the corresponding timestamp period identifier and system load level index. The timestamp period identifier is set as a periodic scalar representing the equipment operating shift. The system load level index is set as an operating scalar that characterizes the current processing power of the equipment. The periodic scalar and the runtime scalar are concatenated for features, and then transformed into a continuous contextual feature representation through a linear mapping network. The specific calculation formula is as follows: ; in Indicates the first A continuous context feature representation vector at each time step. and Let represent the weight matrix and bias vector of the linear mapping network, respectively. This represents a column vector formed by concatenating a periodic scalar and a running scalar and then transposing them.

[0036] In this embodiment, the context feature representation, reconstruction residual, and uncertainty metric are mapped to feature representation vectors of the same dimension. The first feature vector generated in the preceding steps is then obtained. The multidimensional reconstructed residual vector at each time step and the scalar of prediction variance as a measure of uncertainty To unify feature dimensions, a common target mapping dimension is set as follows. This represents a continuous context feature vector. Multidimensional reconstruction of residual vector and prediction variance scalar Each dimension is mapped to the target dimension using an independent feedforward neural network, and the specific mapping formula is as follows: ; ; ; in , and These represent mappings to dimensions. The subsequent context feature representation vector, residual feature representation vector, and uncertainty feature representation vector, and These represent the feature mapping weight matrices of the corresponding feedforward neural network. This represents the feature map weight column vector used for scalar dimension upscaling. , and These represent the mapping bias vectors of the corresponding feedforward neural networks.

[0037] In this embodiment, a self-attention mechanism is used to calculate the attention score between feature representation vectors. The set of feature representation vectors formed by the aforementioned mapping results is defined as follows: To capture the autocorrelation within the feature representation vector set, the aggregate query vector of the feature representation vector set is first calculated using the following formula: ; in This represents the aggregate query vector generated by mean pooling of the feature representation vector set itself. The value of can be one to three. For the in the set... Feature representation vectors The interaction score between the self-attention network and the aggregated query vector is calculated using the following formula: ; ; in Indicates the first Each feature representation vector contains unnormalized attention weights. and Let these represent the query weight matrix and key weight matrix within the self-attention network, respectively, with superscripts indicating their relative positions. This represents the vector transpose operation. This represents the operation of an exponential function with the natural constant as the base. This represents the attention score after normalization. The value can be one to three.

[0038] Preferably, the feature representation vectors are weighted and summed based on the attention scores to generate a calibration feature set. Based on the calculated attention scores, all vectors in the feature representation vector set are linearly weighted and summed, with the specific calculation formula as follows: ; in This represents the first generation generated after weighted summation and fusion. The integrated feature vectors of each time step are aggregated within the time window corresponding to the online monitoring sequence data to generate a calibration feature set. .

[0039] In this embodiment, through the above steps, the operating environment parameters, physical reconstruction errors, and model inference confidence of industrial equipment are mapped to a unified dimension and adaptively weighted and fused, providing a comprehensive data basis for subsequent dynamic threshold calculation and anomaly score calibration.

[0040] Step S400 recalibrates the preliminary anomaly score based on the calibration feature set, calculates the dynamic threshold corresponding to the current online monitoring sequence data, and outputs the calibrated anomaly score and dynamic threshold.

[0041] In step S400 of this embodiment, the preliminary anomaly score is recalibrated based on the calibration feature set, and the dynamic threshold corresponding to the current online monitoring sequence data is calculated. The calibrated anomaly score and dynamic threshold are then output. Specifically, this may include the following steps: S401 maintains a sliding window that stores a set of historical calibration features; S402 calculates the distribution deviation index of the calibration feature set relative to the distribution of the historical calibration feature set within the sliding window; S403 recalibrates the initial anomaly score based on the distribution deviation index and calculates the dynamic threshold corresponding to the current online monitoring sequence data, outputting the calibrated anomaly score and dynamic threshold.

[0042] Further, in step S403 of this embodiment, the preliminary anomaly score is recalibrated based on the value of the distribution deviation index, and a dynamic threshold is calculated. The calibrated anomaly score and the dynamic threshold are then output. Specifically, this may include: S431 calculates the adjustment weight of the preliminary anomaly score and the adjustment ratio of the threshold based on the value of the distribution deviation index. S432 multiplies the initial anomaly score by the adjusted weight to obtain the calibrated anomaly score; S433 obtains a static baseline threshold set based on historical normal data, adds a threshold offset generated based on the adjustment ratio to the static baseline threshold, and generates a dynamic threshold.

[0043] Specifically, in a preferred embodiment, a sliding window is first maintained to store historical calibration feature sets. For example, for industrial equipment in the current... The online monitoring sequence data at each time step is used to obtain the comprehensive fusion feature vector generated in the aforementioned steps, which serves as an element of the calibration feature set. A sliding window is constructed to characterize the historical operating features of the device. The time step length of the sliding window is set to... To address the issue of missing sequences at the initial time step, a baseline feature vector of pre-extracted historical normal operating conditions of industrial equipment is set as follows: When the time step index value is less than or equal to zero, the comprehensive fusion feature vector of the corresponding time step is set to equal the baseline feature vector. Extract the continuous sequence before the current time step. The feature vectors of each historical time step constitute a sliding window of the historical calibration feature set, which is represented as follows: ,in This represents the integrated feature vector generated at the previous time step.

[0044] Preferably, the distribution deviation index of the calibration feature set relative to the distribution of historical calibration feature sets within the sliding window is calculated. The eigenvalue vector of all feature vectors within the sliding window is calculated using the following formula: ; in Indicates the first The feature mean vector representing the recent baseline operating state of industrial equipment within a sliding window, calculated at each time step. The comprehensive fusion feature vector generated at the current time step is then calculated. With the feature mean vector The spatial distance between them is used as an indicator of distribution deviation, and the specific calculation formula is as follows: ; in The calculated distribution deviation index quantifies the specific physical distance between the current multi-source fusion characteristics of industrial equipment and its recent historical operating benchmark. This represents the Euclidean 2 norm operation.

[0045] Preferably, the preliminary anomaly score is recalibrated based on the distribution deviation index value, and the dynamic threshold corresponding to the current online monitoring sequence data is calculated. The calibrated anomaly score and dynamic threshold are then output. Based on the distribution deviation index value, a preset mapping function is used to calculate the adjustment weight of the preliminary anomaly score and the adjustment ratio of the calculated threshold. The specific calculation formula is as follows: ; ; in This indicates the adjusted weights for the initial outlier scores. This indicates the adjustment ratio for calculating the threshold. and These represent the pre-defined positive numerical weighting adjustment coefficient and threshold adjustment coefficient, respectively. This represents the operation of an exponential function with the natural constant as the base. The aforementioned steps, for this industrial equipment, are obtained in the [missing information - likely a specific step or condition]. Preliminary anomaly scores calculated at each time step The adjusted weights are used to perform a multiplication recalibration operation, and the specific calculation formula is as follows: ; in This represents the anomaly score of the industrial equipment at the current time step after calibration, output after recalibration calculation.

[0046] Optionally, a static baseline threshold set based on historical normal data is obtained, and a threshold offset generated based on an adjustment ratio is added to the static baseline threshold to generate a dynamic threshold. The static baseline threshold is set as the value determined based on the maximum preliminary anomaly score of the industrial equipment in the historical full health verification set. Using the aforementioned adjustment ratio The static baseline threshold is scaled to generate a threshold offset, which is then added to the static baseline threshold. The specific calculation formula is as follows: ; in This represents the threshold offset generated based on the adjustment ratio. This represents the dynamic threshold corresponding to the current online monitoring sequence data, and is compared with the aforementioned calibrated anomaly score. Together, they serve as the final anomaly determination output for the current time step of the industrial equipment.

[0047] In this embodiment, the above steps enable adaptive bidirectional adjustment of the anomaly judgment benchmark and anomaly score, which mitigates the numerical fluctuation interference caused by the switching of industrial equipment operating conditions and improves the accuracy of the overall detection results.

[0048] Step S500 compares the calibrated anomaly score with the dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, the current online monitoring sequence data is determined to be abnormal, and the target anomaly detection result is output.

[0049] In a preferred embodiment, in step S500, the calibrated anomaly score is compared with a dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, the current online monitoring sequence data is determined to be abnormal, and the target anomaly detection result is output. Specifically, this may include the following steps: S501 compares the abnormal score after calibration with the value of the dynamic threshold; When the S502 generates an alarm signal containing a timestamp and the severity of the anomaly after calibration, it serves as the result of the target anomaly detection. S503 marks the online monitoring sequence data that triggers the alarm signal as concept drift candidate samples and stores them in the dynamic sample library.

[0050] Specifically, in this embodiment, it is preferable to compare the calibrated anomaly score with the dynamic threshold value. The anomaly score calculated in the aforementioned steps for the industrial equipment at the current [number]th [position / step] is obtained. Post-calibration anomaly score at each time step and the corresponding dynamic threshold Confirm the dynamic threshold. The value must be a real number that is strictly greater than zero to prevent mathematical overflow caused by a zero denominator in subsequent division operations. The abnormal scores after calibration are compared with the dynamic threshold to determine whether the current physical operating state of the industrial equipment deviates from the normal numerical range benchmark.

[0051] Preferably, when the calibrated anomaly score exceeds the dynamic threshold, an alarm signal containing a timestamp and the severity of the anomaly is generated as the target anomaly detection result. If the comparison result shows a calibrated anomaly score... Strictly greater than the dynamic threshold If the online monitoring sequence data representing the current operating status of industrial equipment is found to be abnormal, then the severity of the anomaly is calculated based on the score exceeding the limit. The specific calculation formula is as follows: ; in This indicates the calculated severity of the abnormality reflecting the current critical state of the industrial equipment failure. Extracting this... Each time step corresponds to the absolute physical timestamp of data acquisition from industrial equipment. Physical timestamp Severity of abnormality Data is stitched and encapsulated to generate a digital alarm signal, which is then output as the target anomaly detection result of the industrial equipment at the current time step. If the anomaly score is calibrated... Less than or equal to the dynamic threshold If the current industrial equipment is operating normally, no alarm will be triggered and a normal operating status indicator will be output directly.

[0052] Optionally, the online monitoring sequence data that triggers the alarm signal is labeled as a concept drift candidate sample and stored in a dynamic sample library. Simultaneously with generating the alarm signal, the original online monitoring sequence data at the current time step that triggers the alarm signal, i.e., the multidimensional state feature vector, is extracted. The multidimensional state feature vector Drift candidate samples, representing potential fundamental changes in the underlying physical operating conditions of equipment, are classified and labeled for business purposes. A dynamic sample library for storing drift verification data is pre-built in the system's storage medium, and the labeled multidimensional state feature vectors are then used for this purpose. and its corresponding physical timestamp The bound data is appended to this dynamic sample library.

[0053] In this embodiment, the above steps enable accurate interception and quantitative classification of abnormal equipment states, and close-loop collection of potential operating condition variation feature samples, providing an accurate data source for subsequent automated model iteration.

[0054] Example 2: Most anomaly detection methods rely on a single reconstruction error feature and employ static, fixed judgment thresholds, lacking a comprehensive consideration of model inference confidence and historical data distribution deviation. They struggle to adaptively perceive dynamic data changes and mitigate environmental disturbances when facing equipment operating condition switching and data concept drift. To address these issues, one embodiment of this application also provides an anomaly detection system combining uncertainty modeling and anomaly perception calibration, such as... Figure 2 As shown, the system includes: The basic anomaly detection module is used to acquire online monitoring sequence data of the target system, input the online monitoring sequence data into the pre-trained basic anomaly detection model, and output the corresponding preliminary anomaly score and reconstruction residual. The uncertainty estimation module is used to estimate the uncertainty of the reasoning process of the basic anomaly detection model and calculate the statistical index for the initial anomaly score as an uncertainty measure. The calibration feature construction module is used to extract the time and operating status information corresponding to the online monitoring sequence data as context features, and to fuse the context features, reconstruction residuals and uncertainty measures to construct a calibration feature set. The dynamic calibration module is used to recalibrate the preliminary anomaly score based on the calibration feature set, calculate the dynamic threshold corresponding to the current online monitoring sequence data, and output the anomaly score and dynamic threshold after calibration. The anomaly detection module compares the calibrated anomaly score with the dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, the current online monitoring sequence data is determined to be abnormal, and the target anomaly detection result is output.

[0055] Specifically, in this embodiment, the basic anomaly detection module is used to acquire online monitoring sequence data of the target system and input the online monitoring sequence data into a pre-trained basic anomaly detection model to output the corresponding preliminary anomaly score and reconstruction residual. The uncertainty estimation module is used to perform uncertainty estimation on the inference process of the basic anomaly detection model and calculate a statistical index for the preliminary anomaly score as an uncertainty measure. The calibration feature construction module is used to extract the time and running status information corresponding to the online monitoring sequence data as context features and fuse the context features with the reconstruction residual and uncertainty measure to construct a calibration feature set. The dynamic calibration module is used to perform recalibration operation on the preliminary anomaly score based on the calibration feature set and calculate the dynamic threshold corresponding to the current online monitoring sequence data to output the calibrated anomaly score and the dynamic threshold. The anomaly judgment module is used to compare the calibrated anomaly score with the dynamic threshold and determine that the current online monitoring sequence data is abnormal when the calibrated anomaly score exceeds the dynamic threshold to output the target anomaly detection result.

[0056] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An anomaly detection method combining uncertainty modeling and anomaly perception calibration, characterized in that, Includes the following steps: S100 acquires online monitoring sequence data of the target system, inputs the online monitoring sequence data into a pre-trained basic anomaly detection model, and outputs the corresponding preliminary anomaly score and reconstruction residual; S200 performs uncertainty estimation on the reasoning process of the basic anomaly detection model and calculates a statistical index for the preliminary anomaly score as an uncertainty measure. S300 extracts the time and operating status information corresponding to the online monitoring sequence data as context features, and fuses the context features, the reconstruction residual, and the uncertainty metric to construct a calibration feature set; S400 performs a recalibration operation on the preliminary anomaly score based on the calibration feature set, calculates the dynamic threshold corresponding to the current online monitoring sequence data, and outputs the calibrated anomaly score and the dynamic threshold. S500 compares the calibrated anomaly score with the dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, it determines that the current online monitoring sequence data is abnormal and outputs the target anomaly detection result.

2. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 1, characterized in that, The step of inputting the online monitoring sequence data into a pre-trained basic anomaly detection model and outputting the corresponding preliminary anomaly score and reconstruction residual specifically includes: S101 uses a pre-set autoencoder network to perform latent space encoding and decoding reconstruction on the online monitoring sequence data to generate reconstructed sequence data; S102 calculates the difference between the online monitoring sequence data and the reconstructed sequence data at corresponding time values, and generates the reconstruction residual; S103 calculates the distance norm of the reconstructed residual and uses the distance norm as a preliminary anomaly score.

3. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 1, characterized in that, Uncertainty estimation is performed on the inference process of the basic anomaly detection model, and a statistical index for the preliminary anomaly score is calculated as an uncertainty measure. This specifically includes the following steps: S201 performs independent perturbation inference on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores; S202 calculates the statistical dispersion of the prediction set and uses the statistical dispersion as a statistical indicator.

4. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 3, characterized in that, The step of performing independent perturbation inference on the same online monitoring sequence data to generate a prediction set composed of preliminary anomaly scores specifically includes: S211 activates the Monte Carlo random deactivation mechanism in the neural network layer of the basic anomaly detection model; S212 performs independent forward propagation inference on the same online monitoring sequence data to generate a prediction set.

5. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 1, characterized in that, Extracting the time and operational status information corresponding to the online monitoring sequence data as context features, and fusing the context features, the reconstructed residuals, and the uncertainty metric to construct a calibration feature set, specifically includes the following steps: S301 Extracts the timestamp period identifier and system load level index of the online monitoring sequence data, and converts the timestamp period identifier and the system load level index into a continuous context feature representation; S302 maps the context feature representation, the reconstruction residual, and the uncertainty metric value into feature representation vectors of the same dimension; S303 performs weighted summation and fusion on the feature representation vectors to generate a calibration feature set.

6. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 5, characterized in that, The step of weighted summation and fusion of the feature representation vectors to generate a calibration feature set specifically includes: S331 uses a self-attention mechanism to calculate the attention score between the feature representation vectors; S332 performs a weighted summation and fusion of the feature representation vectors based on the attention scores to generate a calibration feature set.

7. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 1, characterized in that, The process of recalibrating the preliminary anomaly score based on the calibration feature set, calculating the dynamic threshold corresponding to the current online monitoring sequence data, and outputting the calibrated anomaly score and the dynamic threshold specifically includes the following steps: S401 maintains a sliding window that stores a set of historical calibration features; S402 calculates the distribution deviation index of the calibration feature set relative to the distribution of historical calibration feature sets within the sliding window; S403 performs a recalibration operation on the preliminary anomaly score based on the value of the distribution deviation index, calculates the dynamic threshold corresponding to the current online monitoring sequence data, and outputs the calibrated anomaly score and the dynamic threshold.

8. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 7, characterized in that, The process of recalibrating the initial anomaly score based on the value of the distribution deviation index, calculating a dynamic threshold, and outputting the calibrated anomaly score and the dynamic threshold specifically includes: S431 calculates the adjustment weight of the preliminary anomaly score and the adjustment ratio of the calculation threshold based on the value of the distribution deviation index. S432 multiplies the preliminary anomaly score by the adjusted weight to obtain the calibrated anomaly score; S433 obtains a static baseline threshold set based on historical normal data, adds a threshold offset generated based on the adjustment ratio to the static baseline threshold, and generates the dynamic threshold.

9. The anomaly detection method combining uncertainty modeling and anomaly perception calibration according to claim 1, characterized in that, The step of comparing the calibrated anomaly score with the dynamic threshold, and determining that the current online monitoring sequence data is abnormal if the calibrated anomaly score exceeds the dynamic threshold, and outputting the target anomaly detection result, specifically includes the following steps: S501 compares the calibrated anomaly score with the value of the dynamic threshold; S502 When the calibrated anomaly score is greater than the dynamic threshold, an alarm signal containing a timestamp and the severity of the anomaly is generated as the target anomaly detection result. S503 marks the online monitoring sequence data that triggered the alarm signal as a concept drift candidate sample and stores it in the dynamic sample library.

10. An anomaly detection system combining uncertainty modeling and anomaly perception calibration, characterized in that, The system includes: The basic anomaly detection module is used to acquire online monitoring sequence data of the target system, input the online monitoring sequence data into the pre-trained basic anomaly detection model, and output the corresponding preliminary anomaly score and reconstruction residual. The uncertainty estimation module is used to estimate the uncertainty of the reasoning process of the basic anomaly detection model and calculate the statistical index for the preliminary anomaly score as an uncertainty measure. The calibration feature construction module is used to extract the time and operating status information corresponding to the online monitoring sequence data as context features, and to fuse the context features, the reconstruction residuals, and the uncertainty measure values ​​to construct a calibration feature set. The dynamic calibration module is used to perform recalibration operation on the preliminary anomaly score based on the calibration feature set, calculate the dynamic threshold corresponding to the current online monitoring sequence data, and output the calibrated anomaly score and the dynamic threshold. as well as The anomaly detection module is used to compare the calibrated anomaly score with the dynamic threshold. If the calibrated anomaly score exceeds the dynamic threshold, the current online monitoring sequence data is determined to be abnormal, and the target anomaly detection result is output.

Images