Low-orbit satellite communication link multi-dimensional time sequence data anomaly analysis and detection method
Patent Information
- Application Number
- CN202611120768.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-27
- Publication Date
- 2026-09-15
Smart Images
Figure CN122764310A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of low-Earth orbit satellite communication technology, and in particular to a method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit satellite communication links. Background Technology
[0002] In the operation and maintenance of low-Earth orbit (LEO) satellite communications, link quality assessment, fault tracing and location, and maintenance and handling are the core keys to ensuring the stable and efficient operation of satellite communication systems. Unlike geostationary satellites in high orbits with fixed orbits and stable link states, LEO satellites are characterized by low orbital altitude, high speed, dynamic and drastic changes in the relative position between the satellite and the ground, and strong time-varying link characteristics. These are the core features that distinguish LEO satellite communication systems from traditional satellite communications. LEO satellites orbit the Earth at high speeds, and the coverage window for a single satellite is short. Antenna elevation angle, transmission distance, and spatial propagation loss change dynamically on a second-by-second basis with the satellite's transit trajectory, directly causing various core operational data of the communication link to be constantly in a state of dynamic fluctuation. At the same time, the massive network operation of LEO satellites, the large number of terminal accesses, and the high frequency of link interactions further exacerbate the multi-dimensional dynamic coupling characteristics of link data.
[0003] During the operation of low-Earth orbit (LEO) satellite communication links, massive amounts of multi-dimensional time-series data are generated, covering core indicators such as reference signal received power, signal-to-noise ratio (SNR), Doppler shift, modulation and coding scheme (MCS), signal strength, channel quality indicator (CQA), block error rate (BIR), uplink and downlink rates, and link latency. These indicators can intuitively reflect the real-time operational status of the link. Therefore, conducting accurate link anomaly analysis and detection based on multi-dimensional time-series data is a necessary core means to quickly identify link quality issues, accurately locate faults, improve overall operation and maintenance efficiency, and ensure the quality of LEO satellite communication services. It is crucial for the stable operation and maintenance of the entire satellite communication system.
[0004] Currently, anomaly detection in satellite communication links within the industry commonly employs machine learning-based methods. Patent application number 2025100193727 discloses a satellite network data anomaly detection method based on CNN and RWav-KAN fusion feature extraction. This method leverages convolutional neural networks to mine spatial features of network traffic, combines this with the RWav-KAN model to extract multi-scale temporal features, and achieves satellite network data anomaly identification through dual-branch feature fusion. Patent application number 2024111482444 discloses a satellite telemetry data anomaly detection method based on DTW. This method calculates the temporal similarity between the telemetry sequence to be tested and a standard sequence, and determines anomalies in satellite telemetry data based on a preset threshold. Patent application number 2026107052762 discloses a satellite telemetry data anomaly detection method based on reinforcement learning dynamic threshold optimization for routine on-orbit satellite monitoring scenarios. This method utilizes reinforcement learning algorithms to iteratively learn the changing patterns of telemetry data, adaptively updating the global anomaly judgment threshold to achieve real-time anomaly screening of telemetry data.
[0005] However, existing satellite data anomaly detection methods still have significant limitations in the complex dynamic operation scenarios of low-Earth orbit satellites: existing methods are unable to distinguish between the regular fluctuations of indicators induced by the high-speed motion of low-Earth orbit satellites and the abnormal indicator deviations caused by hardware failures and environmental interference; at the same time, most existing methods only analyze single indicators and lack multi-indicator coupling and correlation verification mechanisms, making it difficult to identify hidden faults induced by the imbalance of multiple parameters, resulting in a high risk of false positives and false negatives, and failing to achieve accurate location of the root cause of the fault. Summary of the Invention
[0006] In view of this, this invention proposes a method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit (LEO) satellite communication links. This invention combines the physical laws of LEO satellite orbital motion (periodic fluctuations in data indicators and frequent link switching) with the coupling and correlation characteristics of multiple indicators. Based on multi-dimensional time-series data of the links, it conducts comprehensive analysis and anomaly detection, effectively solving the core problems of traditional solutions that cannot distinguish between normal fluctuations and abnormal offsets in indicators, resulting in high false positive and false negative rates. At the same time, it avoids the drawbacks of conventional optimization solutions, such as low timeliness and inability to accurately classify fault types. This method enables accurate judgment of link anomalies and classification and location of multiple types of faults, effectively improving the accuracy and timeliness of LEO satellite communication fault operation and maintenance, and providing reliable technical support for high-quality link operation and maintenance.
[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0008] A method for anomaly analysis and detection of multidimensional time-series data in low-Earth orbit satellite communication links includes the following steps:
[0009] Step 1: Collect raw time series index data of multi-dimensional links in low-orbit satellite communication. After cleaning, missing data filling, noise filtering and time series alignment standardization preprocessing, construct a unified and standardized time series sample set.
[0010] Step 2: Based on the low-orbit satellite switching cycle, the time series sample set is divided into different groups. Dynamic time warping clustering combined with high-order polynomial fitting is used to complete the time series trend division. Subclassification is completed according to the inflection point and time series pattern. Multi-index communication physical constraints are used to verify the rationality of the trend, so as to accurately distinguish the time series change pattern of satellite transit indicators. If it is determined to be reasonable, proceed to step 4; otherwise, proceed to step 3.
[0011] Step 3: Divide the antenna into different intervals according to the antenna elevation angle, construct an anomaly detection model for each interval to complete the coarse judgment of a single index, fuse Kalman filter prediction to eliminate random measurement jitter, verify the coupling matching degree through the correlation coefficient of multiple indices, and complete the joint discrimination of explicit over-limit anomalies and implicit coupling anomalies.
[0012] Step 4: Based on the time-series trend labels, single-indicator threshold judgment results, and multi-dimensional coupling verification conclusions, complete the comprehensive anomaly analysis, classify the fault types, generate a standardized fault analysis report, and simultaneously complete data archiving.
[0013] Furthermore, the specific method of step 1 is as follows:
[0014] Step 1.1: Perform basic cleaning on the collected raw data of multi-dimensional link timing indicators of low-orbit satellite communication, which includes timestamps, link timing observations, satellite identifiers, link identifiers and terminal identifiers. This includes field integrity checks, duplicate record deletion, and outlier value removal.
[0015] Step 1.2: Group the cleaned data based on the unique identifiers of satellite, orbit, and terminal;
[0016] Step 1.3: Impute missing values in the grouped data. For data with a single missing breakpoint, based on the physical characteristic of the approximately linear change of the communication time-series signal, a linear function is constructed using the two most recent valid values before and after the missing point to complete the missing value fitting and imputation. Formula:
[0017] )
[0018] Parameter description: The timestamp of the missing point and the link metric data are as follows: The timestamps of the valid points to the left of the missing points and the link metric data are as follows: The timestamps of valid points to the right of the missing points and the link metric data are as follows: ,in , and timestamps of missing points Known link metric data for missing points unknown;
[0019] For scenarios with consecutive missing intervals, the k-nearest neighbor algorithm is used based on the local similarity of time series data. It selects the k nearest neighbor valid time series segments before and after the missing window and calculates the neighborhood weighted average as the missing interval filling value.
[0020] Step 1.4: For the data after missing data filling, filter out two types of noise generated during the data signal acquisition process: one is high-frequency random Gaussian noise, and the other is pulse spike noise. For high-frequency random Gaussian noise, a fixed sliding window is used to slide point by point along the time sequence, and the arithmetic mean of all sample data in the window is used to replace the original sampled data at the center of the window. For pulse spike noise, the same sliding window filtering strategy is used, and the median of the sorted data in the window is selected to replace the data at the center of the window.
[0021] Step 1.5: Perform sequence alignment on the noise-filtered time series to ensure that the number of valid data points for different link metrics within the same group remains consistent. The target length of the current group is calculated based on the arc segment corresponding to the current group's cycle number and the sampling frequency requirement of once every 10 seconds. Subsequently, a differentiated alignment strategy is applied for further processing.
[0022] For short time series where the number of original data points is less than the target length, the missing values at intermediate moments are supplemented by linear interpolation based on the original time axis, thereby extending the series length to the preset target length.
[0023] For long-running sequences where the number of original data points exceeds the target length, time points are uniformly extracted at fixed steps, and redundant data is removed at equal intervals to compress the sequence length.
[0024] Furthermore, the specific method for step 2 is as follows:
[0025] Step 2.1: Based on the preprocessed time series data, the time series sample set is divided into different groups with reference to the low-orbit satellite switching cycle, and each link index sample set is constructed. Each sample in the link index sample set is all the corresponding link index data in a group.
[0026] Step 2.2: For a single link metric, extract K samples from the corresponding link metric sample set through unsupervised time-series clustering and use them as the initial cluster centers;
[0027] Step 2.3: For each sample in the link indicator sample set, calculate the DTW distance between the sample and the K cluster centers, and assign each sample to the cluster corresponding to the nearest cluster center;
[0028] Step 2.4: For the new clusters obtained after the update, calculate the sum of the DTW distance values between each sample in the cluster and all other samples in the cluster, and take the sample corresponding to the minimum value of the summation as the new cluster center of the cluster in the next iteration.
[0029] Step 2.5: Repeat steps 2.3-2.4 above to continuously generate new clusters through multiple rounds of iteration until all clusters have converged. The algorithm finally outputs K complete clusters.
[0030] Step 2.6: For each link index based on the known data, execute steps 2.1-2.5 to obtain K complete clusters. For the nonlinear curve characteristics of the sample data in each cluster, obtain the polynomial order n of the curve corresponding to the current cluster.
[0031] Step 2.7: After obtaining a new set of time series samples to be tested, construct corresponding samples for each link index in the set of time series samples to be tested, calculate the DTW distance between the sample to be tested and the K cluster centers of the corresponding link index, and select the cluster with the smallest DTW distance as the best matching cluster.
[0032] Step 2.8: Based on the order n of the curve polynomial corresponding to the best matching cluster, construct the higher-order polynomial of the sample to be tested; based on the index values corresponding to each time series index in the sample to be tested and the calculation results of the higher-order polynomial of each time series index, perform least squares optimal coefficient solution to obtain the polynomial coefficients of each term of the higher-order polynomial.
[0033] Step 2.9: Calculate the second derivative of the higher-order polynomial and determine the inflection point. Record the number of inflection points of the nonlinear curve corresponding to the test sample and the time series corresponding to the inflection point as the time series trend label of the test sample.
[0034] Step 2.10: Based on the fundamental theory of satellite communication, conduct joint analysis on the link indicators within the same group to verify whether the time-series trend labels of different link indicators conform to the constraints of satellite communication theory. If they conform to the constraints, proceed to step 4. For data groups that do not meet the constraints of satellite communication theory, mark them as anomalies and proceed to step 3.
[0035] Furthermore, in step 2.6, the specific method for obtaining the polynomial order n of the curve corresponding to the current cluster based on the nonlinear curve characteristics of the sample data within each cluster is as follows:
[0036] For a single-arch curve, n=2 is defined; for an S-shaped trend curve, n=3 is defined; for a double-peak / double-trough curve, n=4 is defined; and for a fluctuating curve with three or more peaks and troughs, n=5 is defined.
[0037] Furthermore, step 3 is performed as follows:
[0038] Step 3.1: Divide the antenna elevation angle from 0° to 90° into multiple independent intervals, and split the standardized time series samples into segments according to the elevation angle, and establish independent statistical threshold models for each interval;
[0039] Step 3.2: Establish a physical state transition model for satellite motion. Using the changes in satellite radial velocity, propagation distance, and pitch angle as state variables, construct the link state transition equation to provide a physical basis for subsequent predictions based on Kalman filtering.
[0040] Step 3.3: Using the standardized time-series samples after the elevation angle slice as input, run the outlier detection algorithm based on empirical cumulative distribution independently for each elevation angle interval, and adaptively generate the normal upper and lower limit thresholds of the index for that interval based on the sample distribution within the interval.
[0041] Step 3.4: Compare the measured values of the indicators with the adaptive thresholds of the corresponding elevation angle intervals for each sample. Mark the samples that continuously exceed the threshold interval as single-indicator coarse anomalies to complete the first round of coarse screening.
[0042] Step 3.5: Based on the link state transition equation in Step 3.2, build an independent Kalman filter model for each link index. For the coarse anomaly samples of the single index selected by coarse screening, import the original noisy time series sampling value corresponding to the sample. First, predict the theoretical value of the index at the next moment based on the orbital motion law, and then perform weighted correction by combining the measured sampling value to output the smoothed optimal index estimation sequence.
[0043] Step 3.6: Based on the smoothed optimal index estimation sequence, compare it again with the normal upper and lower limit thresholds of the index in each elevation angle interval, remove false anomalies caused by random jitter in a single measurement, and retain the real single index anomaly samples that continuously deviate from the threshold.
[0044] Step 3.7: For the selected real single-index anomaly samples, match the physical standard trend corresponding to the satellite orbit, complete the time series pattern matching, and finally determine the validity of the single index anomaly;
[0045] Step 3.8: Construct multi-indicator core coupled index pairs, and calculate the correlation coefficient based on the smoothed optimal index estimation sequence for each elevation angle interval:
[0046]
[0047] in, The correlation coefficient between link metric P and link metric Q. and These are the m-th data points of link metrics P and Q, respectively, where M is the data volume;
[0048] It belongs to extremely strong synergy. It belongs to a high degree of collaboration. It belongs to the medium level of collaboration. This represents low-level collaboration;
[0049] Step 3.9: If the correlation coefficient of a certain set of indicators is much lower than the preset theoretical synergy threshold, mark the multi-dimensional indicator coupling as abnormal;
[0050] Step 3.10: Summarize the judgment results of two types of judgments: single-indicator explicit anomalies and multi-indicator coupled implicit anomalies. Synchronously bind the corresponding pitch angle interval, terminal number, and anomaly start and end time sequence to complete the output of all anomaly features in this step.
[0051] Furthermore, step 4 is specifically implemented as follows:
[0052] Step 4.1: If there are no abnormal tags, the link status is determined to be normal;
[0053] Step 4.2: If any combination of time-series trend label anomaly, single indicator exceeding limit, or multi-indicator coupling and disconnection anomalies exist simultaneously, it is determined that there is a real fault in the link, and a standardized fault report is automatically generated, marking the pitch angle range and anomaly type corresponding to the anomaly.
[0054] Step 4.3: Store the test results and enter the next round of raw time series acquisition and testing cycle to continuously complete the operation and maintenance monitoring of low-orbit satellite links.
[0055] Due to the adoption of the above technical solution, the beneficial effects of this invention compared with the prior art are as follows:
[0056] 1. This invention proposes a hierarchical standardization preprocessing method for time series indicators of low-Earth orbit satellite communication links. This method adopts a full-process time series regularization approach, including hierarchical cleaning, differential missing data filling, dual-type noise filtering, and adaptive alignment of long and short sequences. This overcomes the technical defects of incomplete original link time series data, severe noise interference, inconsistent time series lengths, and easy distortion in the modeling process. Furthermore, it completely preserves the original time series features of the link, unifies the dimensions of multiple indicator data, improves the fitting accuracy of subsequent clustering and anomaly detection models, and ensures the stability and reliability of the entire anomaly detection process from the data source level.
[0057] 2. This invention proposes a multi-dimensional time series trend classification method based on the fluctuation characteristics of various indicators during satellite transit. This method employs a combination strategy of using DTW unsupervised clustering for coarse time series classification, LM least squares high-order polynomials combined with second derivative inflection points for fine nonlinear curve division, and communication physical constraints to verify the rationality of the time series. This overcomes the technical shortcomings of traditional schemes, such as difficulty in distinguishing between normal indicator fluctuations caused by satellite orbital motion and abnormal offsets caused by equipment failures, and the high number of false alarms. Furthermore, it accurately identifies various standard time series patterns in satellite transit scenarios, effectively filters benign numerical fluctuations, and significantly reduces the overall false judgment rate of abnormal trend detection.
[0058] 3. This invention proposes a multi-index correlation anomaly detection method for low-orbit satellite communication based on elevation angle interval division. This method adopts an implementation scheme of independent ECOD adaptive threshold modeling in elevation angle intervals, Kalman filtering to smooth out random sampling jitter, multi-index coupling correlation coefficient verification, and multi-dimensional feature fusion for comprehensive fault judgment. It overcomes the technical defects of traditional global fixed thresholds, which are difficult to adapt to the differences in elevation angle characteristics of different antennas, are easily triggered by instantaneous noise to trigger false anomalies, can only identify single index over-limit problems, and cannot identify multi-index linkage breakage latent faults. It achieves full elevation angle interval threshold adaptive adaptation, eliminates invalid alarms caused by random jitter, and simultaneously covers explicit numerical faults and latent coupled faults to reduce missed detections. At the same time, it can automatically identify various fault types, providing support for rapid fault root cause location. Attached Figure Description
[0059] Figure 1 This is an overall flowchart of the anomaly analysis and detection method for multi-dimensional time-series data of low-orbit satellite communication links in this embodiment of the invention.
[0060] Figure 2 This is a schematic diagram of the time-series trend classification process in an embodiment of the present invention.
[0061] Figure 3 This is a schematic diagram of the abnormal indicator detection process in an embodiment of the present invention. Detailed Implementation
[0062] The invention will be further described below with reference to the accompanying drawings and specific embodiments.
[0063] Methods for anomaly analysis and detection in multidimensional time-series data of low-Earth orbit satellite communication links, such as Figure 1 As shown, it includes the following steps:
[0064] Step 1: Collect raw time series index data of multi-dimensional links in low-Earth orbit satellite communication. After cleaning, missing data filling, noise filtering and time series alignment standardization preprocessing, construct a unified and standardized time series sample set to ensure the integrity of the sampled data and the effectiveness of the time series features.
[0065] Step 2: Based on the low-Earth orbit satellite switching cycle, the time series sample set is divided into different groups. Dynamic time warping (DTW) clustering combined with high-order polynomial fitting is used to complete the time series trend division. Subclassification is completed according to the inflection point and time series pattern. Multi-index communication physical constraints are used to verify the rationality of the trend, so as to accurately distinguish the time series change pattern of satellite transit indicators. If the judgment is reasonable, proceed to step 4; otherwise, proceed to step 3.
[0066] Step 3: Divide the antenna into different intervals according to the antenna elevation angle, construct an anomaly detection model for each interval to complete the coarse judgment of a single index, fuse Kalman filter prediction to eliminate random measurement jitter, verify the coupling matching degree through the correlation coefficient of multiple indices, and complete the joint discrimination of explicit over-limit anomalies and implicit coupling anomalies.
[0067] Step 4: Based on the time-series trend labels, single-indicator threshold judgment results, and multi-dimensional coupling verification conclusions, complete the comprehensive anomaly analysis, classify the fault types, generate a standardized fault analysis report, and simultaneously complete data archiving.
[0068] Furthermore, the specific method of step 1 is as follows:
[0069] Step 1.1: Perform basic cleaning on the collected raw data of multi-dimensional link timing indicators of low-orbit satellite communication, which includes timestamps, link timing observations, satellite identifiers, link identifiers and terminal identifiers. This includes field integrity checks, duplicate record deletion, and outlier value removal.
[0070] Step 1.2: Group the cleaned data based on the unique identifiers of satellite, orbit, and terminal; model different links independently to avoid mixed statistical distributions;
[0071] Step 1.3: Impute missing values in the grouped data. For data with a single missing breakpoint, based on the physical characteristic of the approximately linear change of the communication time-series signal, a linear function is constructed using the two most recent valid values before and after the missing point to complete the missing value fitting and imputation. Formula:
[0072] )
[0073] Parameter description: The timestamp of the missing point and the link metric data are as follows: The timestamps of the valid points to the left of the missing points and the link metric data are as follows: The timestamps of valid points to the right of the missing points and the link metric data are as follows: ,in , and timestamps of missing points Known link metric data for missing points unknown;
[0074] For scenarios with continuous missing intervals, the k-Nearest Neighbor (KNN) algorithm is adopted. Based on the local similarity of time series data, the k nearest effective time series segments before and after the missing window are selected, and the neighborhood weighted average is calculated as the missing interval filling value. Global time series features are used to fill long interval missing intervals and preserve the overall signal fluctuation trend.
[0075] Step 1.4: For the data after missing data imputation, filter out two types of noise generated during data signal acquisition: high-frequency random Gaussian noise and pulse spike noise. Simultaneously, retain the effective inflection points and trend change characteristics of the signal to avoid excessive smoothing leading to the loss of effective abnormal features. For high-frequency random Gaussian noise, a fixed sliding window is used to slide point-by-point along the time sequence, replacing the original sampled data at the center of the window with the arithmetic mean of all sample data within the window. For pulse spike noise, a similar sliding window filtering strategy is used, selecting the median of the sorted data within the window to replace the data at the center of the window.
[0076] Step 1.5: Perform sequence alignment on the noise-filtered time series to ensure that the number of valid data points for different link metrics within the same group remains consistent. The target length of the current group is calculated based on the arc segment corresponding to the current group's cycle number and the sampling frequency requirement of once every 10 seconds. Subsequently, a differentiated alignment strategy is applied for further processing.
[0077] For short time series where the number of original data points is less than the target length, a linear interpolation method is used to supplement the missing values at intermediate moments based on the original time axis, thereby extending the sequence length to the preset target length. The interpolation process strictly follows the changing trend of the original time series and does not cause any loss of original feature information.
[0078] For long-running series with more original data points than the target length, time series points are uniformly extracted at fixed step sizes, and redundant data is removed at equal intervals to compress the sequence length. This ensures that the overall trend, peak, and inflection point positions of the compressed time series remain unchanged.
[0079] Furthermore, such as Figure 2 As shown, the specific method for step 2 is as follows:
[0080] Step 2.1: Based on the preprocessed time series data, the time series sample set is divided into different groups with reference to the low-orbit satellite switching cycle, and each link index sample set is constructed. Each sample in the link index sample set is all the corresponding link index data in a group.
[0081] Step 2.2: For a single link metric, extract K samples from the corresponding link metric sample set through unsupervised time-series clustering and use them as the initial cluster centers;
[0082] Step 2.3: For each sample in the link indicator sample set, calculate the DTW distance between the sample and the K cluster centers, and assign each sample to the cluster corresponding to the nearest cluster center; the DTW distance calculation method is as follows:
[0083]
[0084]
[0085]
[0086] in, For the sample The first in Values of each sampling point, For the sample The first in Values of each sampling point, ; ; For the sample The number of sampling points in the sample. For the sample The number of sampling points in the sample; , and All are assigned the value of infinity; For the sample With sample DTW distance value;
[0087] Step 2.4: For the new clusters obtained after the update, calculate the sum of the DTW distance values between each sample in the cluster and all other samples in the cluster, and take the sample corresponding to the minimum value of the summation as the new cluster center of the cluster in the next iteration.
[0088] Step 2.5: Repeat steps 2.3-2.4 above to continuously generate new clusters through multiple rounds of iteration until all clusters have converged. The algorithm finally outputs K complete clusters.
[0089] Step 2.6: For each link index based on the known data, execute steps 2.1-2.5 to obtain K complete clusters. For the nonlinear curve characteristics of the sample data in each cluster, obtain the polynomial order n of the curve corresponding to the current cluster.
[0090] Step 2.7: After obtaining a new set of time series samples to be tested, construct corresponding samples for each link index in the set of time series samples to be tested, calculate the DTW distance between the sample to be tested and the K cluster centers of the corresponding link index, and select the cluster with the smallest DTW distance as the best matching cluster.
[0091] Step 2.8: Based on the order n of the curve polynomial corresponding to the best-matching cluster, construct the higher-order polynomial of the sample to be tested:
[0092]
[0093] in, The coefficients of each term in the polynomial are to be determined. For time-series indexes, The time series index values are obtained after polynomial fitting, based on and time-series index The optimal coefficients are obtained by performing least squares calculation on the index values in the corresponding test samples. The value;
[0094] Solving for the optimal coefficients of LM least squares
[0095]
[0096] Parameter description:
[0097] The optimal polynomial coefficient vector obtained through iterative solution;
[0098] : A polynomial fitting function based on the current coefficients;
[0099] : Raw time-series observations;
[0100] M represents the number of time-series indexes;
[0101] Step 2.9: Calculate the second derivative and determine the inflection point:
[0102]
[0103] The second derivative of the time series curve, when When the signs of the second derivatives on the left and right sides of a point are opposite, it is recorded as an inflection point; the number of inflection points of the nonlinear curve corresponding to the test sample and the time series corresponding to the inflection points are recorded as the time series trend labels of the test sample.
[0104] Step 2.10: Based on the fundamental theory of satellite communication, conduct joint analysis on the link indicators within the same group to verify whether the time-series trend labels of different link indicators conform to the constraints of satellite communication theory. If they conform to the constraints, proceed to step 4. For data groups that do not meet the constraints of satellite communication theory, mark them as anomalies and proceed to step 3.
[0105] Furthermore, in step 2.6, the specific method for obtaining the polynomial order n of the curve corresponding to the current cluster based on the nonlinear curve characteristics of the sample data within each cluster is as follows:
[0106] For a single-arch curve, n=2 is defined; for an S-shaped trend curve, n=3 is defined; for a double-peak / double-trough curve, n=4 is defined; and for a fluctuating curve with three or more peaks and troughs, n=5 is defined.
[0107] Furthermore, such as Figure 3 As shown, the specific method for step 3 is as follows:
[0108] Step 3.1: Divide the antenna elevation angle from 0° to 90° into multiple independent intervals, and split the standardized time series samples into segments according to the elevation angle, and establish independent statistical threshold models for each interval;
[0109] Step 3.2: Establish a physical state transition model for satellite motion. Using the changes in satellite radial velocity, propagation distance, and pitch angle as state variables, construct the link state transition equation to provide a physical basis for subsequent predictions based on Kalman filtering.
[0110] Step 3.3: Using the standardized time-series samples after the elevation angle slice as input, run the Empirical Cumulative Distribution-based Outlier Detection (ECOD) algorithm independently for each elevation angle interval, and adaptively generate the normal upper and lower limit thresholds of the index for that interval based on the sample distribution within the interval.
[0111] Step 3.4: Compare the measured values of the indicators with the adaptive thresholds of the corresponding elevation angle intervals for each sample. Mark the samples that continuously exceed the threshold interval as single-indicator coarse anomalies to complete the first round of coarse screening.
[0112] Step 3.5: Based on the link state transition equation in Step 3.2, build an independent Kalman filter model for each link index. For the coarse anomaly samples of the single index selected by coarse screening, import the original noisy time series sampling value corresponding to the sample. First, predict the theoretical value of the index at the next moment based on the orbital motion law, and then perform weighted correction by combining the measured sampling value to output the smoothed optimal index estimation sequence.
[0113] Step 3.6: Based on the smoothed optimal index estimation sequence, compare it again with the normal upper and lower limit thresholds of the index in each elevation angle interval, remove false anomalies caused by random jitter in a single measurement, and retain the real single index anomaly samples that continuously deviate from the threshold.
[0114] Step 3.7: For the selected real single-index anomaly samples, match the physical standard trend corresponding to the satellite orbit, complete the time series pattern matching, and finally determine the validity of the single index anomaly;
[0115] Step 3.8: Construct multi-indicator core coupled index pairs, and calculate the correlation coefficient based on the smoothed optimal index estimation sequence for each elevation angle interval:
[0116]
[0117] in, The correlation coefficient between link metric P and link metric Q. and These are the m-th data points of link metrics P and Q, respectively, where M is the data volume;
[0118] It belongs to extremely strong synergy. It belongs to a high degree of collaboration. It belongs to the medium level of collaboration. This represents low-level collaboration;
[0119] Step 3.9: If the correlation coefficient of a certain set of indicators is much lower than the preset theoretical synergy threshold, mark the multi-dimensional indicator coupling as abnormal;
[0120] Step 3.10: Summarize the judgment results of two types of judgments: single-indicator explicit anomalies and multi-indicator coupled implicit anomalies. Synchronously bind the corresponding pitch angle interval, terminal number, and anomaly start and end time sequence to complete the output of all anomaly features in this step.
[0121] Furthermore, step 4 is specifically implemented as follows:
[0122] Step 4.1: If there are no abnormal tags, the link status is determined to be normal;
[0123] Step 4.2: If any combination of time-series trend label anomaly, single indicator exceeding limit, or multi-indicator coupling and disconnection anomalies exist simultaneously, it is determined that there is a real fault in the link, and a standardized fault report is automatically generated, marking the pitch angle range and anomaly type corresponding to the anomaly.
[0124] Step 4.3: Store the test results and enter the next round of raw time series acquisition and testing cycle to continuously complete the operation and maintenance monitoring of low-orbit satellite links.
[0125] Those skilled in the art will recognize that the described embodiments are intended to help readers understand the principles of the invention and should be understood as not limiting the scope of protection of the invention to the described embodiments. Various modifications and variations can be made to the invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the scope of the claims of the invention.
Claims
1. A method for anomaly analysis and detection of multidimensional time-series data in low-Earth orbit satellite communication links, characterized in that, Includes the following steps: Step 1: Collect raw time series index data of multi-dimensional links in low-orbit satellite communication. After cleaning, missing data filling, noise filtering and time series alignment standardization preprocessing, construct a unified and standardized time series sample set. Step 2: Based on the low-orbit satellite switching cycle, the time series sample set is divided into different groups. Dynamic time warping clustering combined with high-order polynomial fitting is used to complete the time series trend division. Subclassification is completed according to the inflection point and time series pattern. Multi-index communication physical constraints are used to verify the rationality of the trend, so as to accurately distinguish the time series change pattern of satellite transit indicators. If it is determined to be reasonable, proceed to step 4; otherwise, proceed to step 3. Step 3: Divide the antenna into different intervals according to the antenna elevation angle, construct an anomaly detection model for each interval to complete the coarse judgment of a single index, fuse Kalman filter prediction to eliminate random measurement jitter, verify the coupling matching degree through the correlation coefficient of multiple indices, and complete the joint discrimination of explicit over-limit anomalies and implicit coupling anomalies. Step 4: Based on the time-series trend labels, single-indicator threshold judgment results, and multi-dimensional coupling verification conclusions, complete the comprehensive anomaly analysis, classify the fault types, generate a standardized fault analysis report, and simultaneously complete data archiving.
2. The method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit satellite communication links according to claim 1, characterized in that, The specific method for step 1 is as follows: Step 1.1: Perform basic cleaning on the collected raw data of multi-dimensional link timing indicators of low-orbit satellite communication, which includes timestamps, link timing observations, satellite identifiers, link identifiers and terminal identifiers. This includes field integrity checks, duplicate record deletion, and outlier value removal. Step 1.2: Group the cleaned data based on the unique identifiers of satellite, orbit, and terminal; Step 1.3: Impute missing values in the grouped data. For data with a single missing breakpoint, based on the physical characteristic of the approximately linear change of the communication time-series signal, a linear function is constructed using the two most recent valid values before and after the missing point to complete the missing value fitting and imputation. Formula: ）； Parameter description: The timestamp of the missing point and the link metric data are as follows: The timestamps of the valid points to the left of the missing points and the link metric data are as follows: The timestamps of valid points to the right of the missing points and the link metric data are as follows: ,in , and timestamps of missing points Known link metric data for missing points unknown; For scenarios with consecutive missing intervals, the k-nearest neighbor algorithm is used based on the local similarity of time series data. It selects the k nearest neighbor valid time series segments before and after the missing window and calculates the neighborhood weighted average as the missing interval filling value. Step 1.4: For the data after missing data filling, filter out two types of noise generated during the data signal acquisition process: one is high-frequency random Gaussian noise, and the other is pulse spike noise. For high-frequency random Gaussian noise, a fixed sliding window is used to slide point by point along the time sequence, and the arithmetic mean of all sample data in the window is used to replace the original sampled data at the center of the window. For pulse spike noise, the same sliding window filtering strategy is used, and the median of the sorted data in the window is selected to replace the data at the center of the window. Step 1.5: Perform sequence alignment on the noise-filtered time series to ensure that the number of valid data points for different link metrics within the same group remains consistent. The target length of the current group is calculated based on the arc segment corresponding to the current group's cycle number and the sampling frequency requirement of once every 10 seconds. Subsequently, a differentiated alignment strategy is applied for further processing. For short time series where the number of original data points is less than the target length, the missing values at intermediate moments are supplemented by linear interpolation based on the original time axis, thereby extending the series length to the preset target length. For long-running sequences where the number of original data points exceeds the target length, time points are uniformly extracted at fixed steps, and redundant data is removed at equal intervals to compress the sequence length.
3. The method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit satellite communication links according to claim 1, characterized in that, The specific method for step 2 is as follows: Step 2.1: Based on the preprocessed time series data, the time series sample set is divided into different groups with reference to the low-orbit satellite switching cycle, and each link index sample set is constructed. Each sample in the link index sample set is all the corresponding link index data in a group. Step 2.2: For a single link metric, extract K samples from the corresponding link metric sample set through unsupervised time-series clustering and use them as the initial cluster centers; Step 2.3: For each sample in the link indicator sample set, calculate the DTW distance between the sample and the K cluster centers, and assign each sample to the cluster corresponding to the nearest cluster center; Step 2.4: For the new clusters obtained after the update, calculate the sum of the DTW distance values between each sample in the cluster and all other samples in the cluster, and take the sample corresponding to the minimum value of the summation as the new cluster center of the cluster in the next iteration. Step 2.5: Repeat steps 2.3-2.4 above to continuously generate new clusters through multiple rounds of iteration until all clusters have converged. The algorithm finally outputs K complete clusters. Step 2.6: For each link index based on the known data, execute steps 2.1-2.5 to obtain K complete clusters. For the nonlinear curve characteristics of the sample data in each cluster, obtain the polynomial order n of the curve corresponding to the current cluster. Step 2.7: After obtaining a new set of time series samples to be tested, construct corresponding samples for each link index in the set of time series samples to be tested, calculate the DTW distance between the sample to be tested and the K cluster centers of the corresponding link index, and select the cluster with the smallest DTW distance as the best matching cluster. Step 2.8: Based on the order n of the curve polynomial corresponding to the best matching cluster, construct the higher-order polynomial of the sample to be tested; based on the index values corresponding to each time series index in the sample to be tested and the calculation results of the higher-order polynomial of each time series index, perform least squares optimal coefficient solution to obtain the polynomial coefficients of each term of the higher-order polynomial. Step 2.9: Calculate the second derivative of the higher-order polynomial and determine the inflection point. Record the number of inflection points of the nonlinear curve corresponding to the test sample and the time series corresponding to the inflection point as the time series trend label of the test sample. Step 2.10: Based on the fundamental theory of satellite communication, conduct joint analysis on the link indicators within the same group to verify whether the time-series trend labels of different link indicators conform to the constraints of satellite communication theory. If they conform to the constraints, proceed to step 4. For data groups that do not meet the constraints of satellite communication theory, mark them as anomalies and proceed to step 3.
4. The method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit satellite communication links according to claim 3, characterized in that, In step 2.6, the specific method for obtaining the polynomial order n of the curve corresponding to the current cluster based on the nonlinear curve characteristics of the sample data within each cluster is as follows: For a single-arch curve, n=2 is defined; for an S-shaped trend curve, n=3 is defined; for a double-peak / double-trough curve, n=4 is defined. For fluctuation curves with three or more peaks and troughs, we define n=5.
5. The method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit satellite communication links according to claim 1, characterized in that, The specific method for step 3 is as follows: Step 3.1: Divide the antenna elevation angle from 0° to 90° into multiple independent intervals, segment the standardized time series samples according to the elevation angle, and establish independent statistical threshold models for each interval; Step 3.2: Establish a physical state transition model for satellite motion. Using the changes in satellite radial velocity, propagation distance, and pitch angle as state variables, construct the link state transition equation to provide a physical basis for subsequent predictions based on Kalman filtering. Step 3.3: Using the standardized time-series samples after the elevation angle slice as input, run the outlier detection algorithm based on empirical cumulative distribution independently for each elevation angle interval, and adaptively generate the normal upper and lower limit thresholds of the index for that interval based on the sample distribution within the interval. Step 3.4: Compare the measured values of the indicators with the adaptive thresholds of the corresponding elevation angle intervals for each sample. Mark the samples that continuously exceed the threshold interval as single-indicator coarse anomalies to complete the first round of coarse screening. Step 3.5: Based on the link state transition equation in Step 3.2, build an independent Kalman filter model for each link index. For the coarse anomaly samples of the single index selected by coarse screening, import the original noisy time series sampling value corresponding to the sample. First, predict the theoretical value of the index at the next moment based on the orbital motion law, and then perform weighted correction by combining the measured sampling value to output the smoothed optimal index estimation sequence. Step 3.6: Based on the smoothed optimal index estimation sequence, compare it again with the normal upper and lower limit thresholds of the index in each elevation angle interval, remove false anomalies caused by random jitter in a single measurement, and retain the real single index anomaly samples that continuously deviate from the threshold. Step 3.7: For the selected real single-index anomaly samples, match the physical standard trend corresponding to the satellite orbit, complete the time series pattern matching, and finally determine the validity of the single index anomaly; Step 3.8: Construct multi-indicator core coupled index pairs, and calculate the correlation coefficient based on the smoothed optimal index estimation sequence for each elevation angle interval: ； in, The correlation coefficient between link metric P and link metric Q. and These are the m-th data points of link metrics P and Q, respectively, where M is the data volume; It belongs to extremely strong synergy. It belongs to a high degree of collaboration. It belongs to the medium level of collaboration. This represents low-level collaboration. Step 3.9: If the correlation coefficient of a certain set of indicators is much lower than the preset theoretical synergy threshold, mark the multi-dimensional indicator coupling as abnormal; Step 3.10: Summarize the judgment results of two types of judgments: single-indicator explicit anomalies and multi-indicator coupled implicit anomalies. Synchronously bind the corresponding pitch angle interval, terminal number, and anomaly start and end time sequence to complete the output of all anomaly features in this step.
6. The method for anomaly analysis and detection of multi-dimensional time-series data in low-Earth orbit satellite communication links according to claim 1, characterized in that, The specific method for step 4 is as follows: Step 4.1: If there are no abnormal tags, the link status is determined to be normal; Step 4.2: If any combination of time-series trend label anomaly, single indicator exceeding limit, or multi-indicator coupling and disconnection anomalies exist simultaneously, it is determined that there is a real fault in the link, and a standardized fault report is automatically generated, marking the pitch angle range and anomaly type corresponding to the anomaly. Step 4.3: Store the test results and enter the next round of raw time series acquisition and testing cycle to continuously complete the operation and maintenance monitoring of low-orbit satellite links.