Pipe burst detection and performance evaluation method based on single point and time series anomaly detection

Abstract

Disclosed in the present invention is a water supply pipe network pipe burst detection and performance evaluation method based on single point and time series anomaly detection. The method comprises the following steps: step (1): carrying out single-point anomalous value detection on real-time monitoring data of a water supply pipe network, and identifying a normal working condition and an anomalous working condition of the water supply pipe network; step (2): carrying out time series anomaly detection on the real-time monitoring data of the water supply pipe network, and identifying the normal working condition and the anomalous working condition of the water supply pipe network; and step (3): integrating a single-point anomaly detection result and a time series anomaly detection result of the water supply pipe network, and accurately detecting and identifying the pipe burst of the water supply pipe network and a monitoring system failure. The method of the present invention can accurately identify the pipe burst and can distinguish the anomalous data of various monitoring points.

Description

Burst pipe detection and performance evaluation method based on single point and time series anomaly detection Technical Field

[0001] The present invention relates to the technical field of pipe burst detection in urban water supply networks, and in particular to a pipe burst detection and performance evaluation method based on single-point and time series anomaly detection. Background Art

[0002] Pipe bursts are a major form of water loss in water supply systems. Although short-lived, they can result in significant water loss. Pipe bursts not only waste significant water resources but also cause pressure drops in the pipe network, impacting normal water supply. Furthermore, pipe ruptures can easily lead to the ingress of contaminants, compromising drinking water quality. Pipe burst detection aims to provide a timely response to pipe bursts and mitigate their potential harm, making it a crucial tool for ensuring urban water security.

[0003] Data-driven methods are a new approach to pipe burst detection. These methods treat pipe burst detection as an anomaly detection problem, detecting bursts by detecting abnormal features in real-time monitoring data. These methods do not require hardware or pipe network models, but instead rely on software to detect anomalies in pipe network monitoring data. This approach offers advantages such as low cost, reduced time consumption, and low labor intensity. However, due to factors such as limited pipe burst monitoring data and interference from dirty data, current data-driven methods have a high false alarm rate for pipe burst detection.

[0004] Data-driven methods can be further categorized as those based on single-point anomaly detection and those based on time series anomaly detection. Single-point anomaly detection methods detect anomalies in individual values ​​of the monitoring data. If anomalies are detected across multiple time points (time windows), a pipe burst alarm is issued. These methods can promptly detect anomalies in the monitoring data and distinguish between normal and abnormal operating conditions within the pipeline network, making them widely used in pipe burst detection. However, these methods cannot accurately identify the factors that induce various anomalies. Therefore, appropriate data preprocessing methods are required before pipe burst detection to eliminate outliers from the monitoring data. Under normal operating conditions, pipeline network monitoring data follows a specific cyclical pattern and is composed of normal values. If a pipe burst occurs in the pipeline network, or if corrupted data is present at some or all monitoring points, the original cyclical pattern of the monitoring data is altered, resulting in the appearance of outliers. If these outliers are detected but their inducing factors are not accurately identified, the false alarm rate of pipe burst detection increases. If no alarm is issued after these outliers are detected, the pipe burst detection rate decreases.

[0005] The time series anomaly detection method takes into account the correlation between monitoring data and discovers abnormal time series by analyzing the changes in the dissimilarity of time series. The time series anomaly detection method can detect these changes. This type of method eliminates the interference of non-stationary conditions on the burst pipe detection results. However, this type of method is easily interfered by noisy data. A small amount of noise may dominate the similarity measurement, which increases the false alarm rate of this type of method.

[0006] The purpose of the present invention is to overcome the above-mentioned shortcomings and provide a burst pipe detection and performance evaluation method based on single point and time series anomaly detection to solve the problems raised in the background technology.

[0007] In order to solve the above technical problems, the present invention adopts a technical solution: a water supply network burst detection and performance evaluation method based on single-point and time series anomaly detection, which comprises the following steps: step (1), performing single-point anomaly detection on the real-time monitoring data of the water supply network to identify the normal working conditions and abnormal working conditions of the water supply network; step (2), performing time series anomaly detection on the real-time monitoring data of the water supply network to identify the normal working conditions and abnormal working conditions of the water supply network; step (3), integrating the single-point and time series anomaly detection results of the water supply network to accurately detect and identify the water supply network burst and monitoring system failure.

[0008] Preferably, the step (1) specifically includes: step (1.1), preparing historical and real-time single-point monitoring data of each monitoring point in the water supply network, so as to perform single-point outlier detection on the real-time monitoring data; step (1.2), using an unsupervised superposition integration algorithm to perform single-point outlier detection on the real-time monitoring data of the water supply network, and identifying single-point outliers in the real-time monitoring data; step (1.3), using statistical theory to perform qualitative detection on individual values ​​of the water supply network monitoring data, and identifying single-point anomalies in the real-time monitoring data.

[0009] Preferably, the step (2) specifically includes: step (2.1), preparing the time series of historical and real-time monitoring data of each monitoring point in the water supply network, so as to perform time series anomaly detection on the real-time monitoring data; step (2.2), performing dissimilarity analysis on the time series of monitoring data of different monitoring points, and determining the abnormal time series between the monitoring points; step (2.3), performing dissimilarity analysis on the time series of monitoring data of the same monitoring point, and determining the abnormal time series of the monitoring point itself.

[0010] Preferably, the step (3) specifically includes: step (3.1), using a single-point outlier detection method to perform single-point outlier detection on various abnormal scenarios of the water supply network; step (3.2), using a time series anomaly detection method to perform time series anomaly detection on various abnormal scenarios of the water supply network; step (3.3), integrating the single-point and time series anomaly detection results to detect and identify various abnormal scenarios of the water supply network; step (3.4), using a burst pipe detection method to detect and identify various abnormal scenarios of the water supply network, and evaluating the burst pipe detection performance of the proposed method.

[0011] Preferably, the step (3.1) specifically includes: when using the single-point outlier detection method to perform single-point outlier detection on various abnormal scenarios of the water supply network, four scenarios are considered: ① a pipe burst occurs in the network; ② dirty data appears at a single monitoring point; ③ dirty data appears at some monitoring points; ④ dirty data appears at all monitoring points; each scenario contains 25 sets of abnormal monitoring data, single-point outlier detection is performed from the moment the outlier starts, and whether to alarm is determined based on the outlier detection results at 5 consecutive moments.

[0012] Preferably, the step (3.2) specifically includes: when using the time series anomaly detection method to perform time series anomaly detection on various abnormal scenarios of the water supply network, four scenarios are considered: ① a pipe burst occurs in the network; ② dirty data appears at a single monitoring point; ③ dirty data appears at some monitoring points; ④ dirty data appears at all monitoring points; each scenario contains 25 sets of abnormal monitoring data, and time series anomaly detection is performed between monitoring points from the moment the abnormal value starts, and whether to alarm is determined based on the time series anomaly detection results at 5 consecutive moments.

[0013] Preferably, the step (3.3) specifically includes: step (3.3.1), detecting whether there are single point or time series anomalies in the monitoring data; step (3.3.2), identifying the situation where the monitoring data of some monitoring points are abnormal; step (3.3.3), identifying the situation where pipe bursts and dirty data appear in all monitoring points; step (3.3.4), evaluating and analyzing the pipe burst detection performance of the method.

[0014] Preferably, step (3.3.1) is specifically as follows: first, the normal operating conditions of the pipeline network and the abnormal conditions of the monitoring data are identified; for single-point monitoring data, if the existence of a single-point outlier is detected based on an unsupervised superposition integration algorithm or based on statistical theory, the moment when the single-point outlier occurs is marked, and the monitoring data at the next moment is continuously subjected to single-point outlier detection; for time series monitoring data, if an abnormal time series is found based on the time series anomaly detection between monitoring points or the time series anomaly detection of the monitoring point itself, the moment when the abnormal time series occurs is marked, and the monitoring data at the next moment is continuously subjected to time series anomaly detection; step (3.3.2) is specifically as follows: if the monitoring data single points and time series of some monitoring points are abnormal, while the monitoring data single points and time series of the remaining monitoring points are normal, it is determined that dirty data occurs in some monitoring points; step (3.3.3) is specifically as follows: if abnormalities are detected in the monitoring data single points and time series of all monitoring points, the burst of the pipeline network and the presence of dirty data in all monitoring points are identified by the increase and decrease of the abnormal values. If the single-point qualitative test results for all monitoring data points are "decreased," it indicates a pipe burst has occurred in the network. Conversely, if a single-point qualitative test result for a particular monitoring data point is "increased," it indicates that all monitoring points in the network have dirty data. In step (3.3.4), the pipe burst detection performance of the method is evaluated using the following metrics: ① Detection accuracy (σ1); ② Anomaly recognition rate (σ2); and ③ Anomaly detection rate (σ3).

[0015] Preferably, the detection accuracy is expressed as: Where N n Indicates the total number of abnormal scenarios, N dn Indicates the number of abnormal scenarios detected;

[0016] The anomaly recognition rate is expressed as: Where N in Indicates the number of abnormal scenarios correctly identified, N n Indicates the total number of abnormal scenarios;

[0017] The anomaly detection rate is expressed as: Where, t dn and t t They represent the detected duration and actual duration of the abnormal event respectively.

[0018] Preferably, the step (3.4) specifically includes: step (3.4.1), when detecting and identifying various abnormal scenarios of the water supply network, removing the single-point abnormal value detection results to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios; step (3.4.2), when detecting and identifying various abnormal scenarios of the water supply network, removing the single-point value qualitative detection results to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios; step (3.4.3), when detecting and identifying various abnormal scenarios of the water supply network, removing the time series abnormal detection results between the monitoring points to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios; step (3.4.4), when detecting and identifying various abnormal scenarios of the water supply network, removing the time series abnormal detection results of the monitoring point itself to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios.

[0019] Beneficial effects of the present invention: The method of the present invention utilizes historical and real-time monitoring data of the water supply network to effectively detect and identify pipe bursts and monitoring point failures in the water supply network. By performing single-point and time series anomaly detection on the real-time monitoring data of the water supply network, abnormal operating conditions of the water supply network can be discovered in a timely manner. Different abnormal scenarios can be accurately distinguished based on different alarm conditions of the single-point and time series anomaly detection results; that is, the method of the present invention can accurately identify pipe bursts and distinguish abnormal situations in the data of various monitoring points. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] FIG1 is a flow chart of a method for detecting and evaluating burst pipes in a water supply network based on single-point and time series anomaly detection;

[0021] FIG2 is a schematic diagram of single point value anomaly detection proposed by the present invention;

[0022] Figure 3 is a schematic diagram of single-point outlier detection based on unsupervised superposition integration proposed in the present invention: (ac) monitoring data time series, (de) comparison of real-time data and historical data, (fg) single-point outlier detection;

[0023] FIG4 is a schematic diagram of single-point outlier detection based on statistical theory proposed in the present invention: (ac) monitoring data time series, (de) comparison of real-time data with historical data, (fg) single-point outlier detection;

[0024] FIG5 is a schematic diagram of the time series anomaly detection between monitoring points proposed by the present invention: (a) monitoring data time series, (bc) comparison of real-time monitoring data time series with historical monitoring data time series, and (d) monitoring data time series anomaly detection;

[0025] FIG6 is a flowchart of time series anomaly detection between monitoring points proposed by the present invention;

[0026] Figure 7 is a schematic diagram of the time series anomaly detection of the monitoring point itself proposed by the present invention: (a) monitoring data time series, (bc) comparison of real-time monitoring data time series with historical monitoring data time series, (c) monitoring data time series anomaly detection

[0027] FIG8 is a flowchart of the time series anomaly detection process of a monitoring point itself proposed by the present invention;

[0028] FIG9 is a schematic diagram of single-point abnormal value detection after a pipe burst occurs in a pipe network according to an embodiment of the present invention: (a) a time series curve of monitoring data, and (b) a single-point value of monitoring data;

[0029] Figure 10 shows the single-point anomaly detection results after dirty data appears at some monitoring points in an embodiment of the present invention: (a) monitoring data time series curve, (b) monitoring data single-point value;

[0030] Figure 11 shows the single-point anomaly detection results after dirty data appears at all monitoring points in an embodiment of the present invention: (a) monitoring data time series curve, (b) monitoring data single-point value;

[0031] Figure 12 shows the time series anomaly detection results after a pipe burst in a pipe network according to an embodiment of the present invention: (a) time series curve of monitoring data, (b) time series between monitoring points, and (cd) time series of the monitoring points themselves;

[0032] Figure 13 shows the time series anomaly detection results after dirty data appears at some monitoring points according to an embodiment of the present invention: (a) monitoring data time series curve, (b) time series between monitoring points, (cd) time series of the monitoring points themselves;

[0033] Figure 14 shows the time series anomaly detection results after dirty data appears at all monitoring points according to an embodiment of the present invention: (a) monitoring data time series curve, (b) time series between monitoring points, (cd) time series of the monitoring points themselves;

[0034] FIG15 is a schematic diagram of the layout of pressure monitoring points of the Net 3 pipe network model according to an embodiment of the present invention;

[0035] FIG16 is a flowchart of experimental conditions and data preparation technology according to an embodiment of the present invention;

[0036] FIG17 is a schematic diagram of a .csv file of monitoring data according to an embodiment of the present invention;

[0037] Figure 18 shows the results of single-point outlier detection based on unsupervised superposition integration according to an embodiment of the present invention: (a) a pipe burst occurs in the pipeline network, (b) dirty data appears at a single monitoring point, (c) dirty data appears at some monitoring points, and (d) dirty data appears at all monitoring points.

[0038] FIG19 shows the results of single-point outlier detection based on statistical theory according to an embodiment of the present invention: (a) a pipe burst occurs in the pipeline network, (b) dirty data appears at a single monitoring point, (c) dirty data appears at some monitoring points, and (d) dirty data appears at all monitoring points.

[0039] Figure 20 shows the time series anomaly detection results between monitoring points according to an embodiment of the present invention: (a) a pipe burst occurs in the pipeline network, (b) dirty data appears at a single monitoring point, (c) dirty data appears at some monitoring points, and (d) dirty data appears at all monitoring points.

[0040] Figure 21 shows the time series anomaly detection results of monitoring points themselves according to an embodiment of the present invention: (a) a pipe burst occurs in the pipeline network, (b) dirty data appears at a single monitoring point, (c) dirty data appears at some monitoring points, and (d) dirty data appears at all monitoring points;

[0041] FIG22 shows the anomaly detection rate, detection accuracy rate, and anomaly recognition rate for various abnormal scenarios according to an embodiment of the present invention;

[0042] FIG23 is a detection result of removing single-point outliers according to an embodiment of the present invention;

[0043] FIG24 is a qualitative test result after removing a single point value according to an embodiment of the present invention;

[0044] FIG25 is a time series anomaly detection result without monitoring points according to an embodiment of the present invention;

[0045] FIG26 shows the anomaly detection result of the time series without the monitoring point itself according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

[0047] Example 1: As shown in Figure 1, a water supply network burst detection and performance evaluation method based on single-point and time series anomaly detection includes the following steps: Step (1): performing single-point anomaly detection on the real-time monitoring data of the water supply network to identify the normal working conditions and abnormal working conditions of the water supply network; Step (2): performing time series anomaly detection on the real-time monitoring data of the water supply network to identify the normal working conditions and abnormal working conditions of the water supply network; Step (3): integrating the single-point and time series anomaly detection results of the water supply network to accurately detect and identify the water supply network burst and monitoring system failure.

[0048] Furthermore, the step (1) specifically includes: step (1.1), preparing historical and real-time single-point monitoring data of each monitoring point in the water supply network, so as to perform single-point outlier detection on the real-time monitoring data; step (1.2), using an unsupervised superposition integration algorithm to perform single-point outlier detection on the real-time monitoring data of the water supply network, and identifying single-point outliers in the real-time monitoring data; step (1.3), using statistical theory to perform qualitative detection on individual values ​​of the water supply network monitoring data, and identifying single-point anomalies in the real-time monitoring data.

[0049] Furthermore, the step (1.1) specifically includes: using x to represent the monitoring data of the monitoring point, the monitoring data of monitoring point 1 is represented as x1, and the real-time monitoring data is represented as Historical monitoring data is represented as The monitoring data of monitoring point 1 at time m is expressed as x1(m). Single point outlier detection is performed by comparing the real-time monitoring data of the monitoring point with the previous n d Compare the real-time monitoring data with the historical monitoring data of the past 24 hours to determine whether the real-time monitoring data is an abnormal value. For example, if you need to determine whether the real-time monitoring data of monitoring point 1 at time m is an abnormal value, then compare the real-time monitoring data With the first n d Historical monitoring data of Tianm time Compare and use various anomaly detection methods to judge Whether it is an outlier.

[0050] Before performing single-point outlier detection on the monitoring data x of each monitoring point, it is necessary to prepare the real-time monitoring data and historical monitoring data of each monitoring point, which can be expressed as:

[0051] Where x 0 (i) (i=1,2,…,m) represents the real-time monitoring data of the monitoring point, x 0 (m) represents the mth real-time monitoring data of the monitoring point, and m is the total number of monitoring data of each monitoring point per day. j (i) (i=1,2,…,m;j=1,2,…,d) represents the historical monitoring data of the monitoring point, x j (m) represents the mth historical monitoring data of the monitoring point j days before, and d is the total number of days of historical monitoring data. Each row of the matrix X represents the real-time and historical monitoring data of the monitoring point at a certain moment, for example, X(i) = [x 0 (i),x 1 (i),…,x j (i),…,x d (i)] represents the real-time and historical monitoring data of the i-th monitoring point. Each column of the matrix X represents the monitoring data of the monitoring point at each time of a day, for example, X(j) = [x j(1),x j (2),…,x j (i),…,x j (m)] T Represents the historical monitoring data of the monitoring point at each moment j days before.

[0052] After collecting the real-time monitoring data of each monitoring point, it is compared with the historical monitoring data of the corresponding time in the previous d days to confirm whether the real-time monitoring data is an outlier. If the mth real-time monitoring data is to be detected as an outlier, the mth real-time monitoring data of all monitoring points and the mth historical monitoring data of the previous d days are prepared, which can be expressed as:

[0053] Where, represents the mth real-time monitoring data of monitoring point k, and n is the number of monitoring points deployed in the pipe network. represents the mth historical monitoring data of monitoring point k in the previous j days. Each row of the matrix X(m) represents the mth historical and real-time monitoring data of a monitoring point, for example (j=1,2,…,d) represents the mth historical and real-time monitoring data of monitoring point k. Each column of the matrix X(m) represents the mth monitoring data of all monitoring points in the pipe network on a certain day, for example, Represents the mth historical monitoring data of the monitoring point j days before.

[0054] Furthermore, the step (1.2) specifically includes: for the detection of single-point outliers in monitoring data, the present invention adopts a machine learning algorithm based on unsupervised superposition integration. This algorithm was first used for power system fault diagnosis. By using the real-time monitoring data of the SCADA system, it can effectively detect and accurately identify power system fault events and abnormal monitoring data. The algorithm is divided into three layers: ① The first layer is the Isolation Forest algorithm; ② The second layer is the K-means clustering algorithm and the local outlier probability algorithm; ③ The third layer is the integration of the K-means clustering algorithm and the local outlier probability algorithm.

[0055] When performing single-point outlier detection on monitoring data, each row of X(m) is used as the data to be detected and input into the unsupervised superposition integration algorithm. For monitoring data of n monitoring points, n single-point outlier detections need to be performed at each moment. For example, taking the monitoring data of monitoring point 1 as an example, A total of d+1 data to be detected are input into the unsupervised superposition integration algorithm to obtain the probability of each monitoring data becoming an abnormal value. If the probability of becoming an outlier is the highest, the real-time monitoring data is marked as an outlier. Otherwise, it means that the real-time monitoring data is a normal value and is not marked. Step (1.2) mainly includes the following steps: Step (1.2.1), input the data to be detected into the independent forest algorithm to obtain the anomaly score of each data; Step (1.2.2), use the anomaly scores obtained by the independent forest algorithm in the first layer as the input of the K-means clustering algorithm in the second layer. In the K-means clustering algorithm, cluster the anomaly scores to obtain binary data 0 (normal) and 1 (abnormal); Step (1.2.3), use the anomaly scores obtained by the independent forest algorithm in the first layer as the input of the local outlier probability algorithm in the second layer, and obtain the outlier probability of each anomaly score in the local probability outlier algorithm; Step (1.2.4), based on the output results of the K-means clustering algorithm and the local outlier probability algorithm, obtain the probability of each anomaly score becoming an outlier, that is, the probability of each data to be detected becoming an outlier.

[0056] Furthermore, the step (1.3) specifically includes: in order to avoid identifying the scenario where dirty data appears at the monitoring point as a pipe burst in the pipe network, the present invention proposes a single-point outlier detection method based on statistical theory. A pipe burst event usually causes the monitoring data to drop rapidly, so the abnormal monitoring value after the pipe burst should be smaller than the normal monitoring value. If the abnormal monitoring value is greater than the normal monitoring value, it can be determined that there is no pipe burst event in the pipe network, but dirty data appears at the monitoring point. In addition, in order to avoid identifying normal monitoring values ​​caused by water demand fluctuations as abnormal monitoring values, real-time monitoring data should be marked as an abnormal value only after exceeding a certain range.

[0057] For the monitoring data x of a single monitoring point, according to the historical monitoring data x i (i=1,2,…,d) to obtain the qualitative threshold [ζ - (x),ζ + )x)]: ζ - (x) = μ(x i )-m k σ(x i ) + (x) = μ(x i )+m k σ(x i )

[0058] x 0 With ζ - (x) and ζ + (x) is compared, which can be divided into three cases: ① If x 0 <ζ - (x), indicating that the real-time monitoring data is an abnormal value and shows a "decreasing" trend compared with the historical monitoring data, and the abnormal detection result is represented by -1; ② If ζ- (x)≤x 0 ≤ζ + (x), indicating that the real-time monitoring data is normal, and the abnormal detection result is represented by 0; ③ If ζ + (x)<x 0 , indicating that the real-time monitoring data is an abnormal value and shows an "increasing" trend compared with the historical monitoring data. The abnormal detection result is represented by 1.

[0059] Furthermore, the step (2) specifically includes: step (2.1), preparing the time series of historical and real-time monitoring data of each monitoring point in the water supply network, so as to perform time series anomaly detection on the real-time monitoring data; step (2.2), performing dissimilarity analysis on the time series of monitoring data of different monitoring points, and determining the abnormal time series between the monitoring points; step (2.3), performing dissimilarity analysis on the time series of monitoring data of the same monitoring point, and determining the abnormal time series of the monitoring point itself.

[0060] Furthermore, the step (2.1) specifically includes: the monitoring data time series refers to a vector containing multiple monitoring values. For example, the monitoring data time series of monitoring point 1 can be expressed as represents the monitoring data of monitoring point 1 at time m, l is the length of the monitoring data time series, that is, the monitoring data time series S1 contains l monitoring data, Represents the monitoring data of monitoring point 1 at time m-l+1. If all monitoring data in S1 are normal values, that is, the shape of the monitoring data time series S1 does not change much, then S1 is regarded as a normal time series of monitoring data. On the contrary, if a certain monitoring data in S1 is abnormal, that is, the shape of the monitoring data time series S1 has changed (compared with the normal time series of monitoring data), then S1 is regarded as an abnormal time series of monitoring data. In order to detect the abnormality of the monitoring data time series, the present invention adopts a method based on the detection of the difference between the monitoring data time series. This method uses the distance between two monitoring data time series to detect the abnormal time series of monitoring data. For the two monitoring data time series S1 and S2, the distance between the monitoring data time series can be expressed as: Where, M(S1,S2) is the dot product of the monitoring data time series S1 and S2, l is the length of the monitoring data time series S1 and S2, μ(S1) and σ(S1) are the mean and standard deviation of the monitoring data time series S1, μ(S2) and σ(S2) are the mean and standard deviation of the monitoring data time series S2, respectively.

[0061] If all monitoring data in the monitoring data time series S1 and S2 are constants, then d(S1, S2) is also a constant, that is, d(S1, S2) remains constant; if a certain monitoring data in the monitoring data time series S1 and S2 changes, it will cause a change in d(S1, S2). Conversely, if it is detected that d(S1, S2) has changed, it means that a certain monitoring data in the monitoring data time series S1 or S2 has changed, that is, there is an abnormal value in the monitoring data. To this end, the present invention discovers abnormal monitoring data time series by detecting the distance change of the monitoring data time series. According to the source of the monitoring data in the monitoring data time series to be detected, it is divided into: ① time series anomaly detection between monitoring points; ② time series anomaly detection of the monitoring point itself. Before detecting the anomaly of the monitoring data time series, it is necessary to prepare the monitoring data time series of each monitoring point. For a single monitoring point 1, its mth monitoring data time series in the previous j days can be expressed as: In the formula, l represents the length of the monitoring data time series, that is, the monitoring data time series contains l monitoring data, the starting monitoring data of the mth monitoring data time series of monitoring point 1 is x1(m-l+1), and the last monitoring data is x1(m).

[0062] The monitoring data time series can be expressed as:

[0063] Where S 0 (i) (i=1,2,…,m) represents the time series of real-time monitoring data of the monitoring point, S 0 (m) represents the time series of the mth real-time monitoring data of the monitoring point, and m is the total number of monitoring data of each monitoring point per day. j (i) (i=1,2,…,m;j=1,2,…,d) represents the time series of historical monitoring data of the monitoring point, S j (m) represents the mth historical monitoring data time series of the monitoring point j days before, and d is the total number of days of historical monitoring data. Each row of the matrix S represents the real-time and historical monitoring data time series of the monitoring point at a certain moment, for example, S(i) = [S 0 (i),S 1 (i),…,S j (i),…,S d (i)] represents the time series of real-time and historical monitoring data of the i-th monitoring point. Each column of the matrix S represents the time series of monitoring data of the monitoring point at each moment of a day, for example, S(j) = [S j (1),S j (2),…,S j (i),…,S j (m)] TRepresents the time series of historical monitoring data at each moment j days before the monitoring point.

[0064] If anomaly detection is to be performed on the mth real-time monitoring data time series, the mth real-time monitoring data time series of all monitoring points and the mth historical monitoring data time series of the previous d days are prepared, which can be expressed as:

[0065] Where, represents the mth real-time monitoring data time series of monitoring point k, and n is the total number of monitoring points deployed in the pipeline network. Represents the mth historical monitoring data of monitoring point k in the previous j days. Each row of the matrix S(m) represents the mth historical and real-time monitoring data time series of a monitoring point, for example, Represents the mth historical and real-time monitoring data time series of monitoring point k. Each column of the matrix S(m) represents the mth monitoring data time series of the monitoring point on a certain day, for example, Represents the time series of the mth monitoring data j days before the monitoring point.

[0066] Furthermore, the step (2.2) specifically includes:

[0067] If the time series of monitoring data to be detected come from different monitoring points, this is called time series anomaly detection between monitoring points. Under normal operating conditions, the monitoring data from different monitoring points in the pipeline network follow the same pattern, that is, the distance between the monitoring data time series at different monitoring points does not vary much. If the monitoring data of a monitoring point contains an outlier, the shape of the monitoring data time series at that monitoring point will change, which will cause the distance between the monitoring data time series to change. Time series anomaly detection between monitoring points can detect this change and, based on this, detect the outlier in the monitoring data.

[0068] If you want to detect whether the time series distance between two monitoring points has changed, take out the row vectors corresponding to the time series of the monitoring data of the two monitoring points, and then calculate the distance between the real-time and historical monitoring data time series of the two monitoring points. The time series anomaly detection between monitoring points can be divided into three steps: ① Calculate the distance of the time series of historical monitoring data ②Calculate the distance of the real-time monitoring data time series ③ General and Compare and confirm Whether it is an outlier.

[0069] Distance of historical monitoring data time series The distance between the monitoring data time series of monitoring points 1 and 2 at time m in the past d days can be directly derived from the distance of the previous real-time monitoring data time series Therefore, when detecting time series anomalies between monitoring points, it is only necessary to calculate the distance between the real-time monitoring data time series. The distance between the monitoring data time series of monitoring points 1 and 2 at time m is: Where, Represents the distance of the real-time monitoring data time series, is the distance of the historical monitoring data time series.

[0070] The decision threshold ζ1(S1, S2) is obtained by calculating the distance of the historical monitoring data time series. ζ1(S1, S2) is given by The mean and variance of are calculated as: Where, and Represents the distance of the monitoring data time series The mean and variance of .

[0071] After obtaining the decision threshold ζ1(S1, S2), the distance between it and the monitoring data time series is Compare and determine the distance between the monitoring data time series of monitoring points 1 and 2 Is it an outlier? It means that the monitoring data of monitoring points 1 and 2 at the current moment are normal, and the output detection result is "normal", represented by 0; otherwise, the output detection result is "abnormal", represented by 1.

[0072] Furthermore, step (2.3) specifically includes: if the time series to be detected come from the same monitoring point, this is called monitoring point's own time series anomaly detection. Under normal operating conditions, the monitoring data of each monitoring point in the pipeline network follows the same rules, that is, the distance of the monitoring data time series of the same monitoring point does not change much. If the monitoring data of a monitoring point has an outlier, causing the monitoring data time series of the monitoring point to change, the distance of the monitoring point's own time series will also change.

[0073] When detecting anomalies in the time series of a monitoring point itself, it is necessary to calculate the distance between the real-time and historical monitoring data time series, as well as the distance between the historical and historical monitoring data time series, and compare them. The detection of anomalies in the time series of a monitoring point itself is mainly divided into three steps: ① Calculate the distance between the historical and historical monitoring data time series ②Calculate the distance between real-time and historical monitoring data time series ③Comparison and confirm Are there any outliers in the .

[0074] In fact, the distance between the historical and historical monitoring data time series This has been calculated in the previous anomaly detection of the monitoring point’s own time series. Each time anomaly detection is performed, only d And get the minimum value According to the distance of the mth monitoring data time series of the previous d days Calculate the decision threshold Where, and are the distances of the monitoring data time series respectively The mean and variance of .

[0075] Getting the decision threshold Then, the minimum value of the distance between it and the monitoring point’s own time series is Compare and judge Is it an outlier? It means that there is no abnormality in the monitoring data time series of the monitoring point at the current moment, and the output detection result is 0; otherwise, the output detection result is 1.

[0076] Furthermore, the step (3) specifically includes: step (3.1), using the proposed single-point outlier detection method to perform single-point outlier detection on various abnormal scenarios of the water supply network. In order to determine the detection effect of the single-point outlier detection method based on unsupervised classification on various abnormal scenarios, the proposed method was tested using various abnormal scenarios, mainly considering four scenarios: ① a pipe burst in the network; ② dirty data appeared at a single monitoring point; ③ dirty data appeared at some monitoring points; ④ dirty data appeared at all monitoring points. Each scenario contains 25 sets of abnormal monitoring data, and single-point outlier detection is performed from the moment the outlier starts, and whether to alarm is determined based on the outlier detection results at 5 consecutive moments.

[0077] In step (3.2), the proposed time series anomaly detection method was used to detect various abnormal scenarios in the water supply network. To determine the effectiveness of the time series anomaly detection method for various abnormal scenarios, the proposed method was tested using various abnormal scenarios, mainly considering four scenarios: ① a pipe burst in the network; ② dirty data at a single monitoring point; ③ dirty data at some monitoring points; and ④ dirty data at all monitoring points. Each scenario included 25 sets of abnormal monitoring data. Time series anomaly detection was performed between monitoring points starting at the moment the abnormal value began, and the decision to issue an alarm was made based on the time series anomaly detection results at five consecutive moments.

[0078] Step (3.3) integrates the single-point and time series anomaly detection results to detect and identify various abnormal scenarios in the water supply network. The integration of single-point and time series anomaly detection results aims to timely detect abnormal values ​​in real-time monitoring data and accurately identify situations where pipes burst in the network or dirty data appear at monitoring points. A sliding time window is used to perform anomaly detection on the monitoring data of each monitoring point, completing single-point and time series anomaly detection at one moment at a time. If a single-point or time series anomaly is detected at a certain monitoring point, the moment corresponding to the single-point or time series anomaly is marked, and the data cleaning method is used to replace the anomaly. When the marked time window reaches a certain length, an abnormal alarm is issued and various abnormal scenarios are identified. It is mainly divided into the following steps:

[0079] Step (3.3.1) detects whether there are single-point or time series anomalies in the monitoring data. First, identify the normal operating conditions of the pipeline network and the abnormalities in the monitoring data. For single-point monitoring data, if the existence of a single-point outlier is detected based on an unsupervised superposition integration algorithm or based on statistical theory, the moment when the single-point outlier appears is marked, and the single-point outlier detection is continued for the monitoring data at the next moment. For time series monitoring data, if an abnormal time series is found based on the time series anomaly detection between monitoring points or the time series anomaly detection of the monitoring point itself, the moment when the abnormal time series appears is marked, and the time series anomaly detection is continued for the monitoring data at the next moment.

[0080] Step (3.3.2) identifies the situation where the monitoring data of some monitoring points are abnormal. If the monitoring data of some monitoring points have abnormalities in single points and time series, while the monitoring data of the remaining monitoring points have no abnormalities in single points and time series, it is judged that some monitoring points have dirty data. For example, the monitoring data of monitoring point 1 has abnormalities, while the monitoring data of monitoring points 2 and 3 have no abnormalities. The monitoring data of monitoring point 1 can detect single-point abnormalities, and the time series of monitoring point 1 itself will also have continuous abnormal alarms, while monitoring points 2 and 3 have no alarms. The distance d(S1, S2) between the monitoring data time series of monitoring points 1 and 2 and the distance d(S1, S3) between the monitoring data time series of monitoring points 1 and 3 are both abnormal values, while the distance d(S2, S3) between the monitoring data time series of monitoring points 2 and 3 is a normal value.

[0081] Step (3.3.3) identifies pipe bursts and dirty data at all monitoring points. If anomalies are detected in both the single-point and time series monitoring data for all monitoring points, the increase and decrease of the anomaly values ​​are used to identify pipe bursts and dirty data at all monitoring points in the pipeline network. If the single-point qualitative detection results of the monitoring data for all monitoring points are "decreased," a pipe burst has occurred in the pipeline network. Conversely, if the single-point qualitative detection result of a monitoring data point is "increased," dirty data is present at all monitoring points in the pipeline network.

[0082] Step (3.3.4), evaluate and analyze the burst detection performance of the method. The proposed method aims to detect single-point and time series anomalies in real-time monitoring data, and combine the single-point and time series anomaly detection results to identify scenarios where pipe bursts occur in the pipeline network and dirty data appear at the monitoring points. Therefore, the following indicators are mainly considered when evaluating the method: ① Detection accuracy (σ1); ② Anomaly recognition rate (σ2); ③ Anomaly detection rate (σ3). Detection accuracy refers to the probability of various abnormal scenarios being detected, that is, identifying single-point or time series anomalies in abnormal scenarios and issuing alarms. Detection accuracy is expressed as: Where N n Indicates the total number of abnormal scenarios, N dn Indicates the number of abnormal scenarios detected.

[0083] The anomaly recognition rate refers to the probability of correctly identifying various anomaly scenarios. For example, among 10 anomaly scenarios, the number of pipe bursts in the pipeline network is 8, and the number of detected pipe bursts is 4. The anomaly recognition rate for pipe bursts in the pipeline network is 4 ÷ 8 = 50%. The anomaly recognition rate is expressed as: Where N in Indicates the number of abnormal scenarios correctly identified, N n Indicates the total number of abnormal scenarios.

[0084] The anomaly detection rate is the ratio of the duration of each detected anomaly scenario to the actual duration of the anomaly scenario. For example, if the duration of dirty data at a monitoring point is 1 hour, and the duration of dirty data detected at the monitoring point is 0.5 hours, the anomaly detection rate is 0.5 ÷ 1 = 50%. The anomaly detection rate is expressed as: Where, t dn and t t They represent the duration of abnormal event detection and actual duration, respectively. Obviously, the higher σ1, σ2, and σ3 are, the better.

[0085] Step (3.4): Detect and identify various abnormal scenarios in the water supply network using the burst detection method, and evaluate the burst detection performance of the proposed method. Step (3.4.1): When detecting and identifying various abnormal scenarios in the water supply network, remove the single-point outlier detection results to obtain the abnormal detection rate, detection accuracy, and abnormal recognition rate of various abnormal scenarios; Step (3.4.2): When detecting and identifying various abnormal scenarios in the water supply network, remove the single-point value qualitative detection results to obtain the abnormal detection rate, detection accuracy, and abnormal recognition rate of various abnormal scenarios; Step (3.4.3): When detecting and identifying various abnormal scenarios in the water supply network, remove the time series anomaly detection results between monitoring points to obtain the abnormal detection rate, detection accuracy, and abnormal recognition rate of various abnormal scenarios; Step (3.4.4): When detecting and identifying various abnormal scenarios in the water supply network, remove the time series anomaly detection results of the monitoring point itself to obtain the abnormal detection rate, detection accuracy, and abnormal recognition rate of various abnormal scenarios.

[0086] In the above process, various anomaly scenarios were detected using both single-point anomaly detection and time series anomaly detection methods. The single-point and time series anomaly detection results were integrated to obtain the final anomaly detection results for each scenario. Four integration strategies were employed: i. removing single-point outlier detection results; ii. removing single-point qualitative detection results; iii. removing time series anomaly detection results between monitoring points; and iv. removing time series anomaly detection results within the monitoring point itself. The final anomaly detection results for each scenario were obtained and saved as anomaly detection results.csv. Based on this, the performance metrics of the proposed method for each anomaly scenario were calculated, namely, detection accuracy, anomaly recognition rate, and anomaly detection rate, and these metrics were saved as anomaly evaluation results.csv.

[0087] Specific implementation cases:

[0088] The present invention proposes a method for detecting and evaluating pipe bursts in water supply networks based on single-point and time-series anomaly detection and performance evaluation. This method utilizes historical and real-time monitoring data from the water supply network to effectively detect and identify pipe bursts and monitoring point failures. By performing single-point and time-series anomaly detection on the real-time monitoring data of the water supply network, abnormal operating conditions of the water supply network are promptly identified. Different abnormal scenarios are accurately distinguished based on the different alarm conditions of the single-point and time-series anomaly detection results. The method specifically includes the following steps:

[0089] Step (1) performs single-point outlier detection on the real-time monitoring data of the water supply network to identify normal and abnormal working conditions of the water supply network. Step (1) specifically includes:

[0090] In step (1.1), a hydraulic simulation of the water supply network is performed to obtain pressure monitoring data under various abnormal scenarios, so as to perform single-point outlier detection on the abnormal monitoring data. Figure 2 shows a schematic diagram of single-point outlier detection. The present invention mainly considers three abnormal scenarios: (a) a pipe burst in the water supply network; (b) a failure at some monitoring points in the water supply network; and (c) a failure at all monitoring points in the water supply network. In step (1.2), the proposed unsupervised superposition integration algorithm is used to perform single-point outlier detection on the pressure monitoring data under various abnormal conditions in the water supply network.

[0091] Figure 3 shows a schematic diagram of single-point outlier detection based on an unsupervised superposition ensemble algorithm. The figure contains real-time and historical monitoring data from two monitoring points, denoted by Monitoring Point 1 and Monitoring Point 2, respectively. Figures 3(a) and 3(b) show the historical monitoring data for Monitoring Points 1 and 2, and Figure 3(c) shows the real-time monitoring data for Monitoring Points 1 and 2, totaling 15 days of historical monitoring data, i.e., d = 15. The monitoring data is collected every 15 minutes, with the first monitoring data collected at 0:15 and the second monitoring data collected at 0:30. The total number of monitoring data collected per day for each monitoring point is 96, i.e., m = 96.

[0092] As shown in Figure 3(a), the first 95 real-time monitoring data of monitoring points 1 and 2 are all normal values, and there is no significant difference compared with the historical monitoring data in Figure 3(b) and Figure 3(c). As shown in Figure 3(a), the 96th real-time monitoring data of monitoring points 1 and 2 ( and ) and historical monitoring data ( and ) showed a significant increase compared to the previous period. As shown in Figure 3(d), the 96th historical monitoring data of monitoring point 1 in the past 15 days are all distributed in the yellow area (i.e. normal range), and the 96th real-time monitoring data of monitoring point 1 is The distribution is above the yellow area, which is obviously deviated from the normal value. As shown in Figure 3(e), the 96th historical monitoring data of monitoring point 2 in the past 15 days are all distributed in the yellow area (i.e. normal range), and the 96th real-time monitoring data of monitoring point 2 is The distribution is above the yellow area and deviates significantly from the normal value.

[0093] As shown in Figure 3(f), if it is necessary to detect the mth real-time monitoring data of monitoring point n Is it an outlier? and the mth historical monitoring data of the previous d days A total of d+1 values ​​are input into the unsupervised superposition integration algorithm to obtain each x n(m) is the probability of being an outlier. If the probability of being an outlier is the highest, it is marked as an outlier; otherwise, it means This is a normal value and is not marked.

[0094] Step (1.3) uses statistical theory to perform qualitative detection on individual values ​​of the water supply network monitoring data to identify single point anomalies in the real-time monitoring data.

[0095] Figure 4 shows a schematic diagram of single-point outlier detection based on statistical theory. The figure contains real-time and historical monitoring data from two monitoring points, represented by monitoring points 1 and 2 respectively. Figures 4(a) and 4(b) show the historical monitoring data of monitoring points 1 and 2, and Figure 4(c) shows the real-time monitoring data of monitoring points 1 and 2, totaling 15 days of historical monitoring data, i.e., d = 15. The monitoring data is collected at a frequency of 15 minutes per time, with the first monitoring data collected at 0:15 and the second monitoring data collected at 0:30. The total number of monitoring data for each monitoring point per day is 96, i.e., m = 96.

[0096] As shown in Figure 4(a), the first 95 real-time monitoring data of monitoring points 1 and 2 are all normal values, which are consistent with the historical monitoring data ( and ) compared with the 96th monitoring data of monitoring point 1. and historical monitoring data Compared with the previous period, there was a significant decrease. The 96th monitoring data of monitoring point 2 and historical monitoring data There has been a significant increase compared to the previous period.

[0097] As shown in Figure 4(d) and Figure 4(e), the light gray area represents the normal range of the monitoring data, and the dark gray line represents the average value of 15 monitoring data. k σ and μ-m k σ represents the upper and lower limits of the interval, respectively. As shown in Figure 4(d), the 96th historical monitoring data for monitoring point 1 are all distributed within the light gray area, while the 96th real-time monitoring data are located below the light gray area, indicating that the real-time monitoring data are smaller than the historical monitoring data. As shown in Figure 4(e), the 96th historical monitoring data for monitoring point 2 are all distributed within the light gray area, while the 96th real-time monitoring data are located above the light gray area, indicating that the monitoring data have increased. Therefore, based on statistical theory, individual monitoring data values ​​can be detected and divided into three categories: ① outliers (increase); ② normal values; and ③ outliers (decrease).

[0098] Figure 5 shows a schematic diagram of single-point anomaly detection after a pipe burst in the pipeline network. Figure 5(a) shows the time series curve of the pressure monitoring data of monitoring points 1 and 2. The monitoring data is collected at a frequency of 15 minutes per time, and each monitoring point contains 96 monitoring data per day. Normal values ​​are distributed in the light gray area, and abnormal values ​​are distributed in the green area. From November 12 to November 15, the historical monitoring data of the pipeline network under normal operating conditions are shown, and November 16 is the real-time monitoring data. The pipeline network burst at 10:30, and monitoring points 1 and 2 began to decline continuously from the 42nd monitoring data.

[0099] Figure 5(b) shows a comparison of five sets of real-time and historical monitoring data from monitoring points 1 and 2 after a pipe burst. As shown in the figure, the five sets of real-time monitoring data (numbers 42, 43, 44, 45, and 46) from monitoring points 1 and 2 all show a significant decrease compared to the corresponding historical monitoring data from the previous four days. In the figure, all five sets of historical monitoring data are distributed within the light gray area (normal), and all five sets of real-time monitoring data are distributed within the dark gray area (abnormal). If an unsupervised superposition integration algorithm is used to perform single-point outlier detection on the five sets of real-time and historical monitoring data, the real-time monitoring data will be labeled "abnormal." Furthermore, the real-time monitoring data is smaller than the historical data. In other words, when statistical theory is used to perform single-point qualitative detection on the real-time and historical monitoring data, the detection result will be "decreased." Therefore, after a pipe burst, single-point outlier detection typically yields the following results: ① Abnormalities are detected in the monitoring data at each monitoring point; ② The outliers show a decreasing trend compared to the normal values.

[0100] Figure 6 shows a schematic diagram of single-point anomaly detection after a pipe burst in the pipeline network. Figure 6(a) shows the time series curve of the pressure monitoring data at monitoring points 1 and 2. The monitoring data is collected at a frequency of 15 minutes per time, and each monitoring point contains 96 monitoring data per day. Normal values ​​are distributed in the yellow area, and abnormal values ​​are distributed in the green area. November 12 to November 15 are historical monitoring data of the pipeline network under normal operating conditions, and November 16 is real-time monitoring data. The pipeline network suffered a pipe burst at 10:30, and monitoring points 1 and 2 began to decline continuously from the 42nd monitoring data.

[0101] Figure 6(b) shows a comparison of five sets of real-time and historical monitoring data from monitoring points 1 and 2 after a pipe burst. As shown in the figure, the five sets of real-time monitoring data (numbers 42, 43, 44, 45, and 46) from monitoring points 1 and 2 all show a significant decrease compared to the corresponding historical monitoring data from the previous four days. In the figure, all five sets of historical monitoring data are distributed within the yellow area (normal), and all five sets of real-time monitoring data are distributed within the green area (abnormal). If an unsupervised superposition integration algorithm is used to perform single-point outlier detection on the five sets of real-time and historical monitoring data, the real-time monitoring data will be marked as "abnormal." Furthermore, the real-time monitoring data are all smaller than the historical data. In other words, when statistical theory is used to perform single-point qualitative detection on the real-time and historical monitoring data, the detection result will be "decreased." Therefore, after a pipe burst, single-point outlier detection typically yields the following results: ① Abnormalities are detected in the monitoring data at each monitoring point; ② The outliers show a decreasing trend compared to the normal values.

[0102] Figure 7 shows a schematic diagram of single-point anomaly detection after dirty data appears at some monitoring points. Figure 7(a) shows the time series curve of pressure monitoring data at monitoring points 1 and 2. The monitoring data is collected at a frequency of 15 minutes per time, and each monitoring point contains 96 monitoring data per day. November 12th to November 15th is historical monitoring data, and November 16th is real-time monitoring data. Starting at 10:30, monitoring point 1 continuously showed multiple dirty data (numbers 42, 43, 44, 45, 46, and 47). The real-time monitoring data at monitoring point 2 are all normal values.

[0103] As shown in Figure 7(b), the five sets of real-time monitoring data (numbers 42, 43, 44, 45, and 46) at monitoring point 1 show significant differences compared to the corresponding historical monitoring data from the past four days. The 42nd, 43rd, and 46th sets of real-time monitoring data showed an increase, while the 44th and 45th sets showed a decrease. In contrast, the five sets of real-time monitoring data at monitoring point 2 showed no significant difference from the historical data and were all distributed within the yellow area. Using an unsupervised superposition ensemble algorithm to perform single-point outlier detection on the five real-time monitoring data sets at monitoring points 1 and 2, the anomaly detection result for monitoring point 1 is "abnormal," while the anomaly detection result for monitoring point 2 is "normal." Furthermore, using statistical theory to perform qualitative testing on the real-time monitoring data at monitoring points 1 and 2, the anomaly detection result for monitoring point 1 is either "increase" or "decrease," while the anomaly detection result for monitoring point 2 is "normal." To this end, after dirty data appears at some monitoring points, single-point outlier detection usually obtains the following results: ① Anomalies are detected at some monitoring points; ② The outliers tend to decrease or increase compared with the normal values.

[0104] Figure 8 shows a schematic diagram of single-point outlier detection after dirty data appears at all monitoring points. Figure 8(a) shows the time series curve of the pressure monitoring data at monitoring points 1 and 2. The monitoring data is collected at a frequency of 15 minutes per time, and each monitoring point contains 96 monitoring data points per day. The historical monitoring data from November 12 to November 15 are all normal values. The real-time monitoring data from November 16 shows that monitoring points 1 and 2 have multiple dirty data points (42nd, 43rd, 44th, 45th, 46th, and 47th) starting at 10:30.

[0105] As shown in Figure 8(b), the five sets of real-time monitoring data (numbers 42, 43, 44, 45, and 46) from monitoring points 1 and 2 are significantly different from the corresponding historical monitoring data from the past four days. The 42nd, 43rd, and 46th sets of real-time monitoring data have increased, while the 44th and 45th sets of real-time monitoring data have decreased. If an unsupervised superposition ensemble algorithm is used to detect single-point outliers in the five sets of real-time monitoring data from monitoring points 1 and 2, the following results can be obtained: and All of them are outliers, that is, the single-point outlier detection results of monitoring points 1 and 2 are "abnormal". If we use statistical theory to perform qualitative detection on the real-time monitoring data of monitoring points 1 and 2, we can get the following results: and Increase, and Decreases, that is, the single-point anomaly qualitative detection results for monitoring points 1 and 2 are "increasing" or "decreasing." Therefore, after dirty data appears at all monitoring points, the single-point anomaly detection results are: ① Anomalies are detected at all monitoring points; ② The anomaly values ​​show an increasing or decreasing trend compared to the normal values.

[0106] In summary, single-point outliers will be detected when a pipe burst occurs in the pipeline network and dirty data appears at the monitoring points. The single-point outlier detection results are different for different abnormal events, as shown in the following: ① After a pipe burst occurs in the pipeline network, each monitoring point can detect a single-point outlier, and the outlier value is smaller than the normal value; ② After dirty data appears at some monitoring points, single-point outliers are detected at the monitoring points with dirty data, and the outliers show an increasing or decreasing trend; ③ After dirty data appears at all monitoring points, single-point outliers can be detected at all monitoring points, and the outliers show an increasing or decreasing trend.

[0107] Step (2) is to perform time series anomaly detection on the real-time monitoring data of the water supply network to identify the normal and abnormal working conditions of the water supply network. The step (2) specifically includes: step (2.1) to perform hydraulic simulation on the water supply network to obtain pressure monitoring data under various abnormal scenarios of the water supply network, so as to perform time series anomaly value detection on the abnormal monitoring data. The present invention mainly considers three abnormal scenarios: (a) a pipe burst occurs in the water supply network; (b) a failure occurs at some monitoring points in the water supply network; (c) a failure occurs at all monitoring points in the water supply network; step (2.2) to perform anomaly detection on the time series of monitoring data of different monitoring points, that is, to identify time series anomalies between monitoring points, as shown in Figure 10.

[0108] Figure 9 shows a schematic diagram of time series anomaly detection between monitoring points. Figure 9(a) shows the time series curves of real-time and historical monitoring data of monitoring points 1 and 2. The historical monitoring data from December 1 to December 15 are historical monitoring data, and the real-time monitoring data on December 16 are real-time monitoring data. The historical monitoring data are all normal values. The 95th real-time monitoring data of monitoring point 1 is an abnormal value, and the other real-time monitoring data are all normal values. represents the distance between the mth monitoring data time series of monitoring points 1 and 2 on the jth day, then the distance between the mth monitoring data time series of monitoring points 1 and 2 can be expressed as is the distance between the real-time monitoring data time series of monitoring points 1 and 2, is the distance between the time series of historical monitoring data of monitoring points 1 and 2. Time series anomaly detection between monitoring points is to compare and confirm Is it an outlier? If it is an abnormal value, it means that the real-time monitoring data time series S1(m) or S2(m) of monitoring point 1 or 2 has changed, and the time series between the monitoring points is marked as "abnormal". If it is a normal value, the time series between monitoring points is marked as “normal”.

[0109] Figure 9(b) shows the 94th monitoring data time series of monitoring points 1 and 2. Since the monitoring data of monitoring points 1 and 2 are both normal values, the 94th monitoring data time series of monitoring point 1 Similar in shape, the 94th monitoring data time series of monitoring point 2 Therefore, the distance between the real-time monitoring data time series of monitoring points 1 and 2 is Distance from the time series of historical monitoring data There is little change compared to It is a normal value, and the time series between monitoring points 1 and 2 is “normal”.

[0110] Figure 9(c) shows the 95th monitoring data time series of monitoring points 1 and 2. The 95th real-time monitoring data of monitoring point 1 is an abnormal value, and the rest of the monitoring data are normal values. As shown in the figure, the 95th real-time monitoring data time series of monitoring point 1 is abnormal. Time series with historical monitoring data The shape has changed significantly compared to the time series of the 95th monitoring data at monitoring point 2. Therefore, the distance between the real-time monitoring data time series of monitoring points 1 and 2 is Distance from the time series of historical monitoring data Compared with the change is larger, that is It is an outlier, and the time series between monitoring points 1 and 2 is “abnormal”.

[0111] Step (2.3) performs anomaly detection on the time series of monitoring data at the same monitoring point, i.e., identifies anomalies in the time series of the monitoring point itself, as shown in FIG11 .

[0112] Figure 10 shows a schematic diagram of time series anomaly detection for monitoring points. Figure 10(a) shows the time series curves of real-time and historical monitoring data for monitoring points 1 and 2. The historical monitoring data is from December 1st to December 15th, and the real-time monitoring data is from December 16th. The historical monitoring data are all normal values. The 95th real-time monitoring data of monitoring point 1 is an anomaly value, and the remaining real-time monitoring data are all normal values.

[0113] use represents the distance between the mth monitoring data time series of the i-th day and the j-th day at monitoring point 1. The distance between the mth real-time monitoring data time series of monitoring point 1 and the mth historical monitoring data time series of the previous 15 days is The distance of the mth historical monitoring data time series in the first 15 days is The time series anomaly detection of the monitoring point itself is to compare and confirm Is the distance of a monitoring data time series in the abnormal value? If it is an abnormal value, it means that the time series of the mth real-time monitoring data of monitoring point 1 has changed, and the time series of monitoring point 1 itself is marked as "abnormal"; if all If all are normal values, the time series anomaly detection result of monitoring point 1 itself is marked as “normal”.

[0114] Figure 10(b) shows the 94th monitoring data time series of monitoring point 1. Since the monitoring data of monitoring point 1 are all normal values, the shape of the 94th monitoring data time series of monitoring point 1 is similar. Therefore, the distance of the time series of monitoring point 1 itself is (i≠j; i,j=0,1,…,15) changes slightly, that is, all All are normal values, and the time series anomaly detection result of monitoring point 1 itself is marked as "normal".

[0115] Figure 10(c) shows the 95th monitoring data time series of monitoring point 1. The 95th real-time monitoring data of monitoring point 1 is an abnormal value, and the rest of the monitoring data are normal values. As shown in the figure, the 95th real-time monitoring data time series of monitoring point 1 is abnormal. Time series with historical monitoring data The shape has changed significantly. Therefore, the distance between the real-time and historical monitoring data time series of monitoring point 1 is The distance from the historical monitoring data time series of monitoring point 1 Compared with the There are outliers in , and the anomaly detection result of the time series of monitoring point 1 itself is marked as "abnormal".

[0116] Figure 12 shows a schematic diagram of time series anomaly detection after a pipe burst in the pipeline network. Figure 10(a) shows the time series curve of pressure monitoring data at monitoring points 1 and 2. Each monitoring point contains 96 monitoring data points per day. November 14 and 15 are historical monitoring data, both of which are normal values. November 16 is real-time monitoring data. The pipe burst occurred at 10:30 a.m., and monitoring points 1 and 2 began to experience a continuous decline from the 42nd monitoring data point.

[0117] Figure 12(b) shows a schematic diagram of time series anomaly detection between monitoring points. The shapes of the four groups of monitoring data time series (the 42nd, 43rd, 44th, and 45th) of monitoring data from monitoring points 1 and 2 on the 16th have changed significantly compared to the monitoring data time series on the 15th. However, since the monitoring data time series of monitoring points 1 and 2 changed at the same time and the change patterns were relatively similar, the distance between the time series of monitoring points 1 and 2 did not change much. For example, the distance between monitoring points 1 and 2 in the 42nd time series on the 16th is The distance from the 42nd time series on the previous day (i.e. the 15th) The change is relatively small, that is, the anomaly detection result of the 42nd time series of monitoring data of monitoring points 1 and 2 on the 16th is "normal". As shown in the figure, if anomaly detection is performed on the distance of the 43rd, 44th and 45th monitoring data time series of monitoring points 1 and 2 on the 16th, the detection results may all be "normal".

[0118] Figures 12(c) and 12(d) are schematic diagrams of the anomaly detection of the time series of monitoring points 1 and 2, respectively. As shown in Figure 12(c), the three groups (42nd, 43rd, and 44th) of monitoring data time series of monitoring point 1 on the 16th have changed significantly in shape compared with the monitoring data time series on the 14th and 15th, resulting in a large change in the distance between the real-time and historical monitoring data time series. For example, the distance between the 42nd real-time (16th) and historical (15th) monitoring data time series of monitoring point 1 is The distance between the 42nd historical (15th day) and historical (14th day) monitoring data time series is Significantly greater than That is, the anomaly detection result of the self-time series of monitoring point 1 is "abnormal". Similarly, the anomaly detection results of the 42nd, 43rd, and 44th self-time series of monitoring point 2 are all "abnormal".

[0119] In summary, after a pipe burst occurs in the pipeline network, time series anomaly detection can usually obtain the following results: ① The time series detection results between monitoring points may be abnormal or normal; ② Anomalies are detected in the time series of the monitoring point itself.

[0120] Figure 13 shows a schematic diagram of time series anomaly detection after dirty data appears at some monitoring points. Figure 13(a) shows the time series curves of pressure monitoring data at monitoring points 1 and 2. Each monitoring point contains 96 monitoring data points per day. November 14 and 15 are historical monitoring data, all of which are normal values. November 16 is real-time monitoring data. Starting at 10:30, monitoring point 1 has multiple consecutive abnormal values ​​(numbers 42, 43, 44, and 45). The monitoring data at monitoring point 2 are all normal values.

[0121] Figure 13(b) shows a schematic diagram of time series anomaly detection between monitoring points. The four groups (42nd, 43rd, 44th and 45th) of monitoring data time series of monitoring point 1 on the 16th have changed significantly compared with the monitoring data time series on the 15th. At the same time, the four groups of monitoring data time series of monitoring point 2 have changed less. Therefore, compared with the historical monitoring data time series, the real-time monitoring data time series of monitoring points 1 and 2 have changed significantly. For example, the distance between the 42nd monitoring data time series of monitoring points 1 and 2 on the 16th is The distance from the monitoring data time series of the previous day (i.e. the 15th) The difference is significant, with the anomaly detection result for the 42nd monitoring data time series between monitoring points 1 and 2 on the 16th being "abnormal." As shown in the figure, if anomaly detection is performed on the distance between the 43rd, 44th, and 45th monitoring data time series between monitoring points 1 and 2 on the 16th, the result is "abnormal."

[0122] Figures 13(c) and 13(d) are schematic diagrams of the anomaly detection of the time series of monitoring points 1 and 2, respectively. As shown in Figure 11(c), the three groups (42nd, 43rd, and 44th) of monitoring data time series of monitoring point 1 on the 16th have changed significantly in shape compared with the monitoring data time series on the 14th and 15th, resulting in a large change in the distance between the real-time and historical monitoring data time series. For example, the distance between the 42nd real-time (16th) and historical (15th) monitoring data time series of monitoring point 1 is The distance between the 42nd historical (15th day) and historical (14th day) monitoring data time series is Significantly greater than That is, the anomaly detection result of the time series of monitoring point 1 itself is "abnormal".

[0123] As shown in Figure 13(d), the three groups of monitoring data time series (the 42nd, 43rd, and 44th) of monitoring data at monitoring point 2 on the 16th have little change compared with the monitoring data time series on the 14th and 15th, and the distance between the real-time and historical monitoring data time series does not change much. For example, the distance between the 42nd real-time (16th) and historical (15th) monitoring data time series of monitoring point 1 is The distance between the 42nd historical (15th day) and historical (14th day) monitoring data time series is and There is no obvious abnormality, that is, the abnormality detection result of the time series of monitoring point 2 itself is "normal".

[0124] In summary, when dirty data appears at some monitoring points, time series anomaly detection can usually obtain the following results: ① Anomalies are detected in the time series between monitoring points; ② Anomalies are detected in the time series of some monitoring points themselves.

[0125] Figure 14 shows a schematic diagram of time series anomaly detection after dirty data appears at all monitoring points. Figure 4.4.6(a) shows the time series curve of pressure monitoring data for monitoring points 1 and 2. Each monitoring point contains 96 monitoring data points per day. November 14 and 15 are historical monitoring data, all of which are normal values. November 16 is real-time monitoring data. Starting at 10:30, monitoring points 1 and 2 have multiple consecutive abnormal values ​​(numbers 42, 43, 44, 45, and 46).

[0126] Figure 14(b) shows a schematic diagram of time series anomaly detection between monitoring points. The four groups (43rd, 44th, 45th and 46th) of monitoring data time series of monitoring points 1 and 2 on the 16th have changed significantly compared with the monitoring data time series on the 15th. If the time series change trends of the real-time monitoring data of monitoring points 1 and 2 are relatively consistent, the time series anomaly detection result between the monitoring points is "normal". If the time series changes of the real-time monitoring data of monitoring points 1 and 2 are significantly different, the time series anomaly detection result between the monitoring points is "abnormal". For example, the distance between monitoring points 1 and 2 in the 43rd monitoring time series on the 16th is The distance from the monitoring data time series of the previous day (i.e. the 15th) The change is relatively small, that is, the abnormal detection results of the 43rd time series of monitoring points 1 and 2 on the 16th are "normal"; the distance between the 46th monitoring data time series of monitoring points 1 and 2 on the 16th is The distance from the monitoring data time series of the previous day (i.e. the 15th) The changes are relatively large, that is, the 46th time series anomaly detection results of monitoring points 1 and 2 on the 16th are "abnormal".

[0127] Figures 14(c) and 14(d) are schematic diagrams of the anomaly detection of the time series of monitoring points 1 and 2, respectively. As shown in Figure 14(c), the three groups (42nd, 43rd, and 44th) of monitoring data time series of monitoring point 1 on the 16th have changed significantly in shape compared with the monitoring data time series on the 14th and 15th, resulting in a large change in the distance between the real-time and historical monitoring data time series. For example, the distance between the 42nd real-time (16th) and historical (15th) monitoring data time series of monitoring point 1 is The distance between the 42nd historical (15th day) and historical (14th day) monitoring data time series is Significantly greater than That is, the anomaly detection result of the self-time series of monitoring point 1 is “abnormal”. Similarly, as shown in Figure 14(d), the anomaly detection results of the self-sequence of monitoring point 2 are all “abnormal”.

[0128] In summary, when dirty data appears at all monitoring points, time series anomaly detection can usually obtain the following results: ① The time series detection results between monitoring points may be abnormal or normal; ② Anomalies are detected in the sequences of all monitoring points themselves.

[0129] A pipe burst in the pipeline network and dirty data at some (or all) monitoring points can both cause anomalies in the monitoring data time series. However, these anomaly detection results may differ depending on the time series. The following are the results: ① A pipe burst occurs in the pipeline network. The anomaly detection results for the time series between monitoring points may be normal or abnormal; anomalies are detected in the time series of all monitoring points. ② Dirty data occurs at some monitoring points. The anomaly detection results for the time series between monitoring points are normal; anomalies are detected in the time series of some monitoring points. ③ Dirty data occurs at all monitoring points. The anomaly detection results for the time series between monitoring points may be normal or abnormal; anomalies are detected in the time series of all monitoring points.

[0130] Step (3): Experiments are conducted using the benchmark test network Net 3 model to verify and evaluate the pipe burst detection performance of the proposed method.

[0131] As shown in Figure 15, it is assumed that three pressure monitoring points are arranged in the pipe network, and their arrangement nodes are 169, 204 and 275, which are represented by pressure monitoring points 1, 2 and 3 respectively.

[0132] The monitoring data from three pressure monitoring points are used to detect single-point and time series anomalies. The experimental conditions and data preparation process are shown in Figure 16, which includes the following steps: (a) simulating the monitoring data of pipe bursts and dirty data at the monitoring points; (b) performing single-point outlier detection on the monitoring data based on the single-point unsupervised classification method; (c) performing time series anomaly detection on the monitoring data based on the time series unsupervised classification method; and (d) integrating the single-point and time series anomaly detection results to obtain detection results for various abnormal scenarios.

[0133] Figure 16 shows a schematic diagram of the monitoring data .csv file, which contains the acquisition date, time, time step, status, and label information for each monitoring point. The status of the monitoring data is divided into normal value (0) and abnormal value (1). The labels of the monitoring data are divided into monitoring data under normal network conditions (0) and monitoring data under abnormal network conditions (1-9). The scenarios in which various monitoring data may be abnormal are shown in Table 1.

[0134] Table 1 Scenarios where various monitoring data appear abnormal

[0135] Figure 17 shows the results of single-point outlier detection based on the unsupervised superposition ensemble algorithm. Four scenarios are considered: ① As shown in Figure 17(a), a pipe burst occurs in the pipeline network, and the monitoring data at monitoring points 1, 2, and 3 are all outliers; ② As shown in Figure 17(b), the monitoring data at monitoring point 1 are all outliers, while the monitoring data at monitoring points 2 and 3 are all normal values; ③ As shown in Figure 17(c), the monitoring data at monitoring points 1 and 2 are all outliers, while the monitoring data at monitoring point 3 is normal; and ④ As shown in Figure 17(d), the monitoring data at monitoring points 1, 2, and 3 are all outliers. If the monitoring data at five consecutive moments are detected as outliers, an anomaly alarm is issued and the anomaly detection result "abnormal" is output, represented by the points in the yellow area in the figure. Otherwise, no abnormal event occurs, and the anomaly detection result "normal" is output, represented by the points in the green area in the figure. As shown in Figure 17, the unsupervised superposition ensemble algorithm can detect outliers in most of the abnormal monitoring data, while not issuing an anomaly alarm for some abnormal monitoring data. Some outliers in the monitoring data may vary slightly, making it difficult to meet the requirement of being detected as an anomaly for five consecutive moments. This can result in some outliers not triggering an anomaly alarm. Furthermore, unsupervised superposition ensemble algorithms can detect pipe bursts and dirty data at all monitoring points, but they cannot identify these two abnormal scenarios.

[0136] Figure 18 shows the results of single-point outlier detection based on statistical theory, considering four scenarios: ① As shown in Figure 18(a), a pipe burst occurs in the pipeline network, and the monitoring data at monitoring points 1, 2, and 3 are all outliers; ② As shown in Figure 4.5.5(b), the monitoring data at monitoring point 1 are all outliers, while the monitoring data at monitoring points 2 and 3 are all normal values; ③ As shown in Figure 18(c), the monitoring data at monitoring points 1 and 2 are all outliers, while the monitoring data at monitoring point 3 are all normal values; ④ As shown in Figure 18(d), the monitoring data at monitoring points 1, 2, and 3 are all outliers. If the monitoring data at five consecutive moments are detected as outliers, an anomaly alarm is issued: ① If any outlier value is greater than the normal value, the anomaly detection result is output as "increasing," represented by a point in the yellow area; ② If all outliers are less than the normal value, the anomaly detection result is output as "decreasing," represented by a point in the orange area. Otherwise, no abnormal event has occurred, and the anomaly detection result is output as "normal," represented by a point in the green area. As shown in Figure 18, the statistical theory-based method can detect some abnormal monitoring data, but most abnormal monitoring data are still not detected. However, this method can identify scenarios where pipe bursts occur in the pipeline network and dirty data appear at all monitoring points.

[0137] Figure 19 shows the results of time series anomaly detection between monitoring points, considering four situations: ① As shown in Figure 19 (a), a pipe burst occurred in the pipeline network, and the monitoring data of monitoring points 1, 2, and 3 were all abnormal values; ② As shown in Figure 19 (b), the monitoring data of monitoring point 1 were all abnormal values, while the monitoring data of monitoring points 2 and 3 were all normal values; ③ As shown in Figure 19 (c), the monitoring data of monitoring points 1 and 2 were all abnormal values, while the monitoring data of monitoring point 3 were all normal values; ④ As shown in Figure 19 (d), the monitoring data of monitoring points 1, 2, and 3 were all abnormal values. If the time series detection results of 5 consecutive moments are all abnormal, an abnormal alarm is issued: ① If the distance between the time series of monitoring data of two monitoring points (such as d m (S1, S2) and d m (S1, S3)) are both abnormal, the output result is "two abnormalities", which are represented by the points in the orange area; ② If there is only one monitoring point, the distance of the monitoring data time series (such as d m (S1,S2) or d m If (S1, S3)) is an anomaly and the time series distance of the monitoring data from another monitoring point is normal, the output result is "single anomaly," represented by a point within the yellow area. ③ If the time series distances of the monitoring data from both monitoring points are normal, no anomaly has occurred, and the output result is "normal," represented by a point within the green area. As shown in Figure 19, the detection rate for pipe bursts based on the time series between monitoring points is low, while the detection rate for scenarios with dirty data at monitoring points is high. This may be because a pipe burst causes a decrease in monitoring data at all monitoring points, and the data changes at each monitoring point follow similar patterns, resulting in smaller changes in the time series distances between monitoring points.

[0138] Figure 20 shows the anomaly detection results for the time series of monitoring points themselves, considering four scenarios: ① As shown in Figure 20(a), a pipe burst occurs in the pipeline network, and the monitoring data at monitoring points 1, 2, and 3 are all outliers; ② As shown in Figure 20(b), the monitoring data at monitoring point 1 are all outliers, while the monitoring data at monitoring points 2 and 3 are all normal; ③ As shown in Figure 20(c), the monitoring data at monitoring points 1 and 2 are all outliers, while the monitoring data at monitoring point 3 are all normal; and ④ As shown in Figure 20(d), the monitoring data at monitoring points 1, 2, and 3 are all outliers. If the time series anomaly detection results for five consecutive moments are all abnormal, an anomaly alarm is issued and the output result is "abnormal," represented by a point in the yellow area. Otherwise, the output result is "normal," represented by a point in the green area. As shown in Figure 20, the time series of monitoring points themselves can effectively detect various abnormal scenarios and identify scenarios where a single monitoring point or some monitoring points have dirty data. However, it cannot accurately identify scenarios where a pipe burst occurs in the pipeline network and where all monitoring points have dirty data.

[0139] The situation where dirty data appears at the monitoring points is detected. Except for scenarios 4 and 8, the σ2 of all scenarios is around 98%. As shown in Figure 21, the proposed method can not only accurately detect outliers in the monitoring data, but also effectively identify various abnormal scenarios. Among them, scenario 4 identifies the abnormal scenario of dirty data appearing at three monitoring points as a scenario of a pipe burst in the pipeline network. When identifying the abnormal scenarios of a pipe burst in the pipeline network and dirty data appearing at the monitoring points, it is usually easy to identify the abnormal scenario of dirty data appearing at a single or partial monitoring point. However, if the monitoring data of all monitoring points are abnormal (all monitoring data are significantly reduced), it may be identified as a scenario of a pipe burst in the pipeline network. Considering the water supply safety, a pipe burst alarm needs to be issued and the suspected pipe burst in the pipeline network needs to be checked.

[0140] Figure 22 shows the anomaly detection results for various scenarios after removing the single-point outlier detection results. As shown in Figure 22, removing the single-point outlier detection results has little impact on the detection results for scenarios 2-9, specifically, on the anomaly scenario where dirty data appears at a monitoring point. However, the detection results for pipe bursts are significantly affected, primarily in terms of anomaly detection and recognition rates. Removing the single-point outlier detection results prevents some abnormal monitoring data from being detected, resulting in a decrease in the anomaly detection rate. Furthermore, when identifying the anomaly scenarios of pipe bursts and dirty data at monitoring points, some instances of pipe bursts are misidentified as dirty data at monitoring points, resulting in a decrease in the anomaly recognition rate. This is primarily due to the fact that after a pipe burst, the monitoring data at each monitoring point decreases, resulting in no anomalies detected in either the time series of the monitoring point itself or the time series between monitoring points. However, single-point outlier detection is able to detect the decrease in pressure monitoring data after the burst.

[0141] Figure 23 shows the detection results for various abnormal scenarios after removing the single-point qualitative detection results. As shown in Figure 23, the anomaly detection rate for all scenarios reached 100%, while the detection accuracy and anomaly identification rates showed a significant decrease. This indicates that, despite false alarms and misidentification of various abnormal scenarios, all abnormal scenarios were detected. Clearly, the single-point qualitative detection results are primarily used to eliminate false alarms. If the single-point qualitative detection results are integrated, the detection accuracy and anomaly identification rates for all scenarios are high, while the anomaly detection rates are all below 100%. Under normal operating conditions, water demand fluctuations due to weather or holidays can cause changes in the monitoring data at various monitoring points in the pipe network. These changes can be detected by anomalies in the time series of the monitoring point itself and between monitoring points. Using the single-point qualitative detection results, abnormal monitoring data alarms caused by water demand fluctuations can be eliminated. Removing the single-point qualitative detection results would increase the false alarm rate for pipe burst detection.

[0142] As shown in Figure 24, removing the time series anomaly detection results between monitoring points has little impact on the detection results for a pipe burst (Scenario 1). However, it has a significant impact on the anomaly scenario involving dirty data at the monitoring point, with the anomaly detection rates for all eight scenarios decreasing significantly. This indicates that the anomaly scenario involving dirty data at the monitoring point results in multiple outliers being undetected. When dirty data appears at a monitoring point, the time series shape of the monitoring data at each or some of the monitoring points changes. When the time series shape of the monitoring data at a monitoring point is consistent with the time series shape of its historical monitoring data, no anomalies are detected in the time series of the monitoring point itself. If these changes in monitoring values ​​are small, it is difficult to detect anomalies based on single-point anomalies. Clearly, these anomalies can only be detected based on anomalies in the time series between monitoring points.

[0143] Figure 25 shows the detection results for various abnormal scenarios after removing the anomaly detection results for the monitoring point's own time series. As shown in Figure 25, both the anomaly detection and recognition rates for various abnormal scenarios decrease. Clearly, the presence of dirty data at a monitoring point alters the shape of its own time series. When abnormal values ​​appear in some monitoring data, the small variations in these values ​​prevent them from being detected by single-point anomaly or inter-point time series anomaly detection methods, resulting in a decrease in the anomaly detection rate. Furthermore, the lack of alarms in the time series of individual monitoring points also reduces the recognition rate for various abnormal scenarios.

Claims

1. A method for burst detection and performance evaluation of water supply network based on single point and time series anomaly detection, characterized by: It includes the following steps: Step (1), performing single-point outlier detection on the real-time monitoring data of the water supply network to identify normal and abnormal operating conditions of the water supply network; Step (2), performing time series anomaly detection on the real-time monitoring data of the water supply network to identify normal and abnormal operating conditions of the water supply network; Step (3) integrates the single-point and time-series abnormality detection results of the water supply network to accurately detect and identify pipe bursts and monitoring system failures in the water supply network.

2. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 1, characterized in that: The step (1) specifically comprises: Step (1.1), preparing historical and real-time single-point monitoring data of each monitoring point in the water supply network, so as to perform single-point outlier detection on the real-time monitoring data; Step (1.2), using an unsupervised superposition integration algorithm to perform single-point outlier detection on the real-time monitoring data of the water supply network, and identifying single-point outliers in the real-time monitoring data; Step (1.3) uses statistical theory to perform qualitative detection on individual values ​​of the water supply network monitoring data to identify single point anomalies in the real-time monitoring data.

3. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 1, characterized in that: The step (2) specifically comprises: Step (2.1), prepare the time series of historical and real-time monitoring data of each monitoring point in the water supply network, so as to perform time series anomaly detection on the real-time monitoring data; Step (2.2), perform dissimilarity analysis on the monitoring data time series of different monitoring points to determine the abnormal time series between the monitoring points; Step (2.3), perform dissimilarity analysis on the monitoring data time series of the same monitoring point to determine the abnormal time series of the monitoring point itself.

4. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 1, characterized in that: The step (3) specifically comprises: Step (3.1), using a single point outlier detection method to perform single point outlier detection on various abnormal scenarios of the water supply network; Step (3.2), using the time series anomaly detection method to perform time series anomaly detection on various abnormal scenarios of the water supply network; Step (3.3), integrating single point and time series anomaly detection results to detect and identify various abnormal scenarios in the water supply network; Step (3.4), use the burst pipe detection method to detect and identify various abnormal scenarios of the water supply network, and evaluate the burst pipe detection performance of the proposed method.

5. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 4, characterized in that: The step (3.1) specifically includes: When using the single-point outlier detection method to detect various abnormal scenarios in the water supply network, four scenarios are considered: ① a pipe burst occurs in the network; ② dirty data appears at a single monitoring point; ③ dirty data appears at some monitoring points; ④ dirty data appears at all monitoring points; each scenario contains 25 groups of abnormal monitoring data, and single-point outlier detection is performed from the moment the outlier starts, and whether to alarm is determined based on the outlier detection results at 5 consecutive moments.

6. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 4, characterized in that: The step (3.2) specifically includes: When using the time series anomaly detection method to detect various abnormal scenarios in the water supply network, four scenarios are considered: ① a pipe burst occurs in the network; ② dirty data appears at a single monitoring point; ③ dirty data appears at some monitoring points; ④ dirty data appears at all monitoring points; each scenario contains 25 groups of abnormal monitoring data, and time series anomaly detection is performed between monitoring points from the moment the abnormal value starts, and whether to alarm is determined based on the time series anomaly detection results at 5 consecutive moments.

7. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 4, characterized in that: The step (3.3) specifically includes: Step (3.3.1), detect whether there are single point or time series anomalies in the monitoring data; Step (3.3.2), identify the abnormal monitoring data of some monitoring points; Step (3.3.3), identify the burst pipe and dirty data at all monitoring points; Step (3.3.4), evaluate and analyze the pipe burst detection performance of the method.

8. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 7, characterized in that: Step (3.3.1) is specifically as follows: first, identify the normal working conditions of the pipeline network and the abnormal conditions of the monitoring data; for single-point monitoring data, if the existence of a single-point outlier is detected based on an unsupervised superposition integration algorithm or based on statistical theory, then mark the moment when the single-point outlier occurs, and continue to perform single-point outlier detection on the monitoring data at the next moment; for time series monitoring data, if an abnormal time series is found based on the time series anomaly detection between monitoring points or the time series anomaly detection of the monitoring point itself, then mark the moment when the abnormal time series occurs, and continue to perform time series anomaly detection on the monitoring data at the next moment; Step (3.3.2) is specifically as follows: if the monitoring data single points and time series of some monitoring points are abnormal, while the monitoring data single points and time series of the remaining monitoring points are normal, it is determined that dirty data exists in some monitoring points; Step (3.3.3) is as follows: If the monitoring data of all monitoring points and the time series are abnormal, the increase and decrease of the abnormal value are used to identify the pipe burst and dirty data of all monitoring points. If the single-point qualitative detection results of the monitoring data of all monitoring points are "decreased", it means that the pipe burst has occurred in the pipe network; On the contrary, if the single-point qualitative detection result of a certain monitoring data is "increased", it means that dirty data has appeared in all the monitoring points of the pipeline network. In step (3.3.4), the burst pipe detection performance of the method is evaluated by considering the following indicators: ① detection accuracy (σ1); ② anomaly recognition rate (σ2); ③ anomaly detection rate (σ3).

9. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 8, characterized in that: The detection accuracy is expressed as: Where N n Represents the total number of abnormal scenarios, N dn Indicates the number of abnormal scenarios detected; The anomaly recognition rate is expressed as: Where N in Represents the number of abnormal scenarios correctly identified, N n Indicates the total number of abnormal scenarios; The anomaly detection rate is expressed as: Where, t dn and t t They represent the detected duration and actual duration of the abnormal event respectively.

10. The method for detecting and evaluating the burst of a water supply pipe network based on single point and time series anomaly detection according to claim 4, characterized in that: The step (3.4) specifically includes: Step (3.4.1), when detecting and identifying various abnormal scenarios of the water supply network, remove the single point outlier detection results to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios; Step (3.4.2), when detecting and identifying various abnormal scenarios of the water supply network, remove the single point value qualitative detection results to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios; Step (3.4.3), when detecting and identifying various abnormal scenarios of the water supply network, remove the abnormal detection results of the time series between the monitoring points to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios; Step (3.4.4), when detecting and identifying various abnormal scenarios of the water supply network, remove the abnormal detection results of the time series of the monitoring point itself to obtain the abnormal detection rate, detection accuracy and abnormal recognition rate of various abnormal scenarios.

Images