CN111694879A

CN111694879A - Multivariate time series abnormal mode prediction method and data acquisition monitoring device

Info

Publication number: CN111694879A
Application number: CN202010439838.6A
Authority: CN
Inventors: 王玲
Original assignee: University of Science and Technology Beijing USTB
Current assignee: University of Science and Technology Beijing USTB
Priority date: 2020-05-22
Filing date: 2020-05-22
Publication date: 2020-09-22
Anticipated expiration: 2040-05-22
Also published as: CN111694879B

Abstract

The invention provides a multivariate time series abnormal mode prediction method and a data acquisition monitoring device; the method comprises the following steps: acquiring an optimal k value of the MMOD algorithm based on historical data according to a natural neighbor principle; carrying out online expansion on the MMOD algorithm to realize online identification of a multivariate time sequence abnormal mode; the conversion from the multi-element time sequence subsequence to the observation sequence is realized according to an increment fuzzy self-adaptive clustering algorithm, a hidden Markov model is built based on a Baum-Welch algorithm and all observation sequences, and the online prediction of the multi-element time sequence abnormal mode is realized based on the built hidden Markov model. According to the invention, related data to be mined can be better acquired through a multi-element time sequence data acquisition system of a cloud platform, and real-time prediction of an abnormal mode of a multi-element time sequence can be realized by utilizing an online density difference abnormal detection algorithm and a Markov prediction model algorithm. And a monitoring system APP is constructed, so that real-time monitoring is facilitated.

Description

Multivariate time series abnormal mode prediction method and data acquisition monitoring device

Technical Field

The invention relates to the technical field of abnormal pattern recognition and prediction systems, cloud platforms and monitoring systems, in particular to a multivariate time series abnormal pattern prediction method and a data acquisition and monitoring device.

Background

Data mining is an emerging technology that has emerged with the development of artificial intelligence and database technologies, which aims at extracting potentially useful information and knowledge hidden within its interior, not previously known to people, from large, fuzzy, random, and practical application data.

The anomaly detection is an important subject in data mining, is widely applied to various fields, and is a hot spot of research of students. As a kind of complex data commonly used in data mining, the related research of the multivariate time series mainly comprises the discretization of the multivariate time series, the similarity measurement of the multivariate time series, the abnormal detection of the multivariate time series and the like. There are often some special multivariate time series subsequences in the multivariate time series, and their behaviors deviate from most other subsequences in the multivariate time series, and such a multivariate time series subsequence which rarely appears is called a multivariate time series abnormal pattern. The proportion of these subsequences is small, but these abnormal patterns tend to contain more useful information than the normal patterns, and are also more valuable to study. For example, in the medical field, by analyzing electrocardiographic data, whether the heart rate of a patient is abnormal or not is rapidly judged, and thus, whether a disease outbreak occurs or not is detected. In the field of network intrusion detection, network node communication flow is detected, when the communication flow is abnormal in a certain time period, the communication flow can be reported in time, and whether network intrusion exists in abnormal segments is further detected. In the industrial field, the flow of industrial components such as engines, turbines, oil, etc. in pipes or other mechanical parts is monitored to detect whether industrial units are damaged by continuous use and normal wear.

The abnormal mode often has a large amount of implicit information, which often contains the reason of the abnormal occurrence and the rule of the abnormal occurrence, and the existing abnormal can be predicted by researching the historical abnormal mode, so that the possibly occurring abnormal can be prevented in advance. In recent years, the amount of data from various fields such as meteorology, hydrology, medicine, and industrial fields has rapidly increased due to the arrangement of a large number of data collection tools including sensors, and how to identify and predict abnormal patterns from such changing data has become an urgent problem to be solved.

Anomaly detection is one of the basic problems in the field of data mining, and to date, there is no accepted statement about the definition of anomalies, and the definition given by Hawkin is generally adopted: an anomaly is data that deviates from the majority of the data in the data set, thereby causing a suspicion that it was generated by another mechanism. The exception to the present invention is given by the definition given by Hawkin.

Early anomaly detection methods mainly aimed at disordered data sets and can be roughly classified into algorithms such as statistical-based methods, distance-based methods, density-based methods, clustering-based methods and the like. Firstly, performing distribution model assumption on an integral data set, and then performing anomaly identification on a small probability event; the distance-based anomaly detection method firstly calculates the distance between each data object and the nearest neighbor of the data object, and then performs anomaly identification on data far away from the nearest neighbor of the data object; the density-based anomaly detection method comprises the steps of firstly estimating the density of each data object, and then carrying out anomaly identification on the data objects with lower densities; the cluster-based anomaly detection method firstly clusters data and then identifies anomalies of cluster clusters which are far away from cluster center data or contain a small number of data objects. The multi-element time sequence subsequence obtained after the segmentation can be regarded as a group of unordered data sets.

Multivariate time series has become popular as a class of important data in a wide range of practical applications, and has attracted considerable attention in recent decades. Many researchers began to extend some of the data-related anomaly detection methods to multivariate time series anomaly detection. The principal component analysis is used by some people to perform dimensionality reduction processing on the multivariate time sequence to obtain a multivariate time sequence mode representation, and then local abnormal factor detection algorithm LOF (local abnormal factor) is used to identify the first M multivariate time sequences with the maximum local abnormal factors as abnormal modes. Although the method can detect global abnormality and local abnormality, the calculation process of the method is complex and is not suitable for detecting the online multivariate time series abnormal mode. In some researches, the segmented multivariate time sequence is clustered, an abnormality score of each multivariate time sequence segment is calculated by using a CBLOF (Cluster-Based LocalOutier Fator) abnormality degree detection algorithm Based on a clustering result, and the multivariate time sequence segment with the abnormality degree larger than a set threshold value is taken as an abnormality mode. The effect of the method is highly dependent on the clustering method, so how to select a proper clustering method is still an important problem. The cluster internal point with the best clustering quality is used as a periodic point identifier to segment the multivariate time sequence, then the characteristic value of each periodic sequence is extracted, and the abnormal pattern recognition of the periodic subsequence is realized by using a normal abnormal classifier constructed by the characteristic information of the periodic subsequence with the label. The algorithm is a supervised multivariate time series abnormal pattern detection algorithm, can only identify periodic abnormality, cannot well detect non-periodic abnormality and is not suitable for online detection of multivariate time series abnormal patterns. And the algorithm takes the average value of k neighbor distances as an abnormal score, and then determines whether the subsequence is abnormal under different abnormal scores based on the concept of fuzzy membership, thereby indirectly and automatically determining the threshold. Although the method can automatically determine the threshold value, the selection of the k value is sensitive to the result of the anomaly detection. The method comprises the steps of firstly reducing dimensions of a multivariate time sequence, then carrying out sparse coding on data after dimension reduction, then constructing a sparse coding characteristic matrix, calculating an abnormal score of the sparse coding characteristic matrix, and considering the abnormal score to be abnormal if the abnormal score is larger than a threshold value. The algorithm can only identify point abnormality of the multivariate time series and cannot identify pattern abnormality of the multivariate time series. There is a report in the literature that multiple times are constructed as a graph structure, sub-sequences or data points are represented by using nodes of the graph, and similarity values of the corresponding nodes are captured by searching weights associated with edges of the graph. If the similarity is large, the method is normal, and if the similarity is small, the method is abnormal. Although this method can identify point anomalies or sub-sequence anomalies, it takes much time to estimate the weight of its edges, which is inefficient.

In summary, how to perform online abnormal pattern prediction on a multivariate time series becomes an urgent problem to be solved.

Disclosure of Invention

The technical problem to be solved by the invention is to provide a multivariate time series abnormal pattern prediction method and a data acquisition monitoring device, so as to solve the problem of online abnormal pattern prediction of multivariate time series.

In order to solve the technical problems, the invention provides the following technical scheme:

a multivariate time series abnormal pattern prediction method comprises the following steps:

according to the principle of natural neighbor, acquiring the optimal k value of an outlier detection algorithm MMOD estimated by density data based on the historical data of a multivariate time sequence, thereby configuring the optimal k value for the MMOD algorithm;

performing online expansion on the MMOD algorithm, and performing abnormal mode detection on the multivariate time sequence according to the configured optimal k value, thereby realizing online identification of the abnormal mode of the multivariate time sequence based on the MMOD algorithm;

the conversion from the multi-element time sequence subsequence to the observation sequence is realized according to an increment fuzzy self-adaptive clustering algorithm, a hidden Markov model of the multi-element time sequence is built based on a Baum-Welch algorithm and all the observation sequences, and the online prediction of the multi-element time sequence abnormal mode is realized based on the built hidden Markov model.

Further, the online identification of the multivariate time series abnormal pattern based on the MMOD algorithm comprises the following steps:

detecting whether a new multi-element time sequence subsequence is generated in the multi-element time sequence in real time;

if a new multivariate time sequence subsequence is generated, calculating the abnormal score of the current multivariate time sequence subsequence on line, and comparing the magnitude relation between the current abnormal score and a preset threshold value in real time;

and if the current abnormal score is larger than the preset threshold value, the current multivariate time sequence subsequence is in an abnormal mode.

Further, the on-line prediction of the multivariate time series abnormal mode based on the constructed hidden Markov model comprises the following steps:

judging the observation state of the current multivariate subsequence in real time based on an incremental fuzzy adaptive clustering algorithm;

and predicting the hidden state of the next multi-element subsequence by using a hidden Markov model based on the observation state sequence of the current multi-element subsequence.

Further, the obtaining of the optimal k value of the outlier detection algorithm MMOD estimated based on the historical data of the multivariate time series according to the principle of natural neighbor includes:

s1, initialize sup_k＝1，nb_i＝0；

S2, searching for sup of each subsequence_kNeighbor subsequence with nb_iNatural neighbor subsequences representing the ith subsequence, using

Storing the reverse neighbor subsequences of the ith subsequence;

s2.1, calculating the number of subsequences with empty natural neighbors and recording the number as

S2.2, if

Go to S3, otherwise sup_k＝sup_k+1 to S2;

s3, determining k as sup_kMaximum number of inverse neighbors under 2 neighbors, i.e.

Further, the online identification of the multivariate time series abnormal pattern based on the MMOD algorithm further comprises:

for a newly arrived multivariate time series subsequence x_tWhen x is_tIs a historical multivariate time series subsequence x_iIn the k-nearest neighbor mode, d (x) is satisfied for all_t,x_i)＜_k(x_i) Of historical multivariate time series subsequence x_iUpdating the abnormal score; storing the k neighbor distance of each multivariate time sequence subsequence;

wherein ,d(x_t,x_i) Is a multi-element time sequence subsequence x_tWith its ith neighbor multivariate time sequence subsequence x_lThe distance of (a) to (b),_k(x_i) Is a multi-element time sequence subsequence x_lThe distance from its k-th neighbor pattern.

Further, the converting of the multivariate time sequence sub-sequence to the observation sequence is realized according to the incremental fuzzy adaptive clustering algorithm, and the hidden markov model of the multivariate time sequence is constructed based on the Baum-Welch algorithm and all the observation sequences, which comprises the following steps:

clustering the subsequences of each variable of the multivariate time sequence according to an incremental fuzzy adaptive clustering algorithm, classifying the subsequences according to a maximum membership principle and symbolizing the subsequences; each different symbol is regarded as an observation state of the multivariate time sequence; thereby realizing the conversion from the multi-element time sequence subsequence to the observation sequence through the increment fuzzy self-adaptive clustering algorithm;

calculating the density estimation abnormal value of each historical multivariate time sequence subsequence, judging the size of the density estimation abnormal value and a preset threshold value, if the density estimation abnormal value is smaller than the preset threshold value, determining the density estimation abnormal value as a normal mode, and otherwise, determining the density estimation abnormal value as an abnormal mode;

if a new observation state is generated, initializing an initial state of the hidden Markov model by using a current observation sequence and an abnormal mode detection result, wherein a matrix pi is obtained by the following formula, BB is randomly assigned, and AA is averaged;

wherein, normalN and abnormalN are the number of normal mode and abnormal mode;

and a hidden Markov model constructed based on the Baum-Welch algorithm and all observation sequences.

Further, the expression of the hidden markov model constructed based on the Baum-Welch algorithm and all observation sequences is as follows:

λ＝(AA,BB,Π)

Π＝[Π₁(normal),Π₂(abnormal)]

wherein AA ═ a_ij](1≤i,j≤N)、BB＝[b_ik](i is more than or equal to 1 and less than or equal to N, k is more than or equal to 1 and less than or equal to M) are respectively a state transition matrix and an emission matrix; a is_ij＝P[i_t+1＝q_j|i_t＝q_i]For the t-th multivariate time series segment is the implicit state q_iAnd the t +1 th multivariate time series segment is the implicit state q_jProbability of (b)_ik＝P[o_t＝v_k|i_t＝q_i]The hidden state for the t-th multivariate time series segment is q_iAnd the observed state is v_kProbability of (pi) < pi >_i](1. ltoreq. i. ltoreq.N) is an initial hidden state matrix, Π_i＝P[i₁＝q_i]Representing the hidden state of the 1 st multivariate time series segment as q_iThe probability of (c).

searching the t-th subsequence implicit state i in the current multivariate time sequence subsequence observation state sequence in all possible paths { i }by using a Viterbi algorithm₁,i₂,L,i_t-1I } and predicting whether the next subsequence is abnormal based on a state transition matrix AA by using the following formula; wherein the length of the observation sequence is t:

when a new multivariate time sequence subsequence is generated, estimating a cluster to which the newly generated multivariate time sequence fragment belongs, and converting the newly generated multivariate time sequence subsequence into a corresponding observation state; calculating the abnormal score of the newly generated multi-element time sequence subsequence, updating the abnormal score of the subsequence with the k adjacent set changed, and judging whether the current multi-element time sequence subsequence is abnormal or not; and when a new observation state is generated, initializing an initial state of the hidden Markov model by using the current observation sequence and the abnormal mode detection result.

Accordingly, in order to solve the above technical problems, the present invention further provides the following technical solutions:

a data acquisition monitoring device comprises a data acquisition module and a cloud platform centralized monitoring module; wherein,

the data acquisition module is used for acquiring monitoring data of local multivariate time series abnormal states in real time, and realizing local data monitoring, historical data sampling storage and uploading of preset real-time data to the cloud platform centralized monitoring system; the monitoring data is obtained by predicting the abnormal state of the local multivariate time series by the multivariate time series abnormal mode prediction method;

the cloud platform centralized monitoring module is used for acquiring real-time monitoring data so as to monitor the data condition.

Furthermore, the data acquisition monitoring device also comprises a data service center;

the data service center uses the real-time historical database to store the real-time data of the production process and provide retrieval service, and uses the business SQL database to store the static data of the business process and provide retrieval service.

The technical scheme of the invention has the following beneficial effects:

the invention provides an online density difference anomaly detection algorithm aiming at the problems that a density peak-based MMOD anomaly detection algorithm cannot process a multivariate time sequence and needs to manually set parameters. Hidden Markov model property is introduced, a Markov prediction model can be constructed by observing the hidden state sequence of the sequence and the historical mode, and real-time prediction of the abnormal mode of the multivariate time sequence is realized.

In addition, the invention also constructs a monitoring system APP, which is convenient for real-time monitoring and is simple and applicable. The whole three parts of the invention form a complete multivariate time series abnormity analysis and monitoring system and device, and provide a beneficial reference for research and development of related fields.

Drawings

FIG. 1 is a flow chart of online anomaly pattern prediction provided by an embodiment of the present invention;

FIG. 2 is a schematic diagram of a data acquisition system according to an embodiment of the present invention;

fig. 3 is a diagram of a data link scheme and an access network structure of a cloud platform according to an embodiment of the present invention;

FIG. 4a is a diagram of an adaptive MMOD anomaly mode diagnostic provided by an embodiment of the present invention;

FIG. 4b is a diagram of an abnormal mode tag provided by an embodiment of the present invention;

FIG. 4c is a LOF abnormal pattern diagnostic chart provided by an embodiment of the present invention;

FIG. 4d is a graph of various algorithms F provided by an embodiment of the present invention;

FIG. 4e shows the abnormal pattern recognition accuracy for different k values of the MMOD according to the embodiment of the present invention;

FIG. 4f is a schematic diagram of the updated number of abnormal scores in the online LOF and online adaptive MMOD modes according to the embodiment of the present invention;

FIG. 4g is a diagram of HMM-based prediction results provided by an embodiment of the present invention;

FIG. 4h is a diagram illustrating an actual abnormal pattern diagnosis provided by an embodiment of the present invention;

FIG. 4i is a graph of predicted results based on LSTM provided by an embodiment of the present invention;

fig. 4j is a comparison graph of online response time of the online anomaly pattern recognition and prediction combination algorithm provided in the embodiment of the present invention.

Detailed Description

In order to make the technical problems, technical solutions and advantages of the present invention more apparent, the following detailed description is given with reference to the accompanying drawings and specific embodiments.

The multivariate time series abnormity comprises point abnormity, mode abnormity and sequence abnormity, and if the points in the sequence deviate from most points, the point abnormity is determined; if the subsequences in the sequence deviate from most subsequences, the pattern is abnormal; a sequence is abnormal if it deviates from most sequences in the set. The invention mainly researches the mode abnormity of a multivariate time sequence, improves MMOD (multi-member object distance) aiming at the problem, obtains a neighbor number k in a self-adaptive manner based on historical data, and provides an online self-adaptive MMOD abnormity mode detection algorithm for online expansion of the neighbor number k. And on-line prediction of a multivariate time series abnormal mode is realized based on a hidden Markov model. And detecting whether a new multivariate time sequence subsequence is generated in the multivariate time sequence in real time, if so, calculating the abnormal score of the current multivariate time sequence subsequence on line, comparing the magnitude relation between the current abnormal score and a threshold value in real time, and if the magnitude relation is larger than the threshold value, considering that the current multivariate time sequence subsequence is an abnormal subsequence, namely an abnormal mode. And the observation state of the current multivariate subsequence is judged in real time based on fuzzy clustering, and the next hidden state is predicted based on the current observation state sequence.

Aiming at the problem that the detection result of the traditional MMOD algorithm is sensitive to k neighbor, the self-adaptive MMOD density detection for automatically obtaining the optimal k neighbor value based on historical data is provided. The method aims at the problem that the traditional multivariate time series anomaly detection algorithm cannot identify an anomaly mode on line. And carrying out online extension on the MMOD algorithm. A hidden Markov model is introduced, a Markov prediction model can be constructed by observing the hidden state sequence of the sequence and the historical mode, and the real-time prediction of the abnormal mode of the multivariate time sequence is realized.

The data acquisition system can better acquire related data to be mined, and the data acquisition system is applied to a multivariate time series abnormality analysis system to evaluate the abnormal state and make further diagnosis. The proposed algorithm enables real-time prediction of the abnormal pattern of a multivariate time series. And finally, a monitoring system APP is constructed, so that real-time monitoring is facilitated. The data acquisition system, the abnormal mode prediction algorithm and the monitoring APP are mutually connected to form a complete system. The invention is illustrated in detail below by means of specific examples.

First embodiment

Referring to fig. 1 to 4j, the present embodiment provides a multivariate time series abnormal pattern prediction method, which is used for a system and a device for analyzing abnormal states of multivariate time series, and provides real-time, accurate and uniform state information through a cloud platform system. Aiming at the problem that the MMOD anomaly detection algorithm based on the data density estimation of the density peak value cannot process a multivariate time sequence and needs to manually set parameters, an online density difference anomaly detection algorithm is provided. And the effectiveness of the online multivariate time series abnormal pattern prediction algorithm is verified on the multivariate time series abnormal state data set. Finally, a novel multivariate time series abnormal mode prediction method is provided in the whole process, and more specific reference opinions are provided for analysis and decision of related multivariate time series abnormal states. The monitoring system APP mainly realizes the query and display, online update and modification of related information, and is convenient for managers to monitor in real time. The following is a detailed description:

method for recognizing and predicting abnormal pattern of (I) multivariate time series

The multivariate time series abnormity comprises point abnormity, mode abnormity and sequence abnormity, and if the points in the sequence deviate from most points, the point abnormity is determined; if the subsequences in the sequence deviate from most subsequences, the pattern is abnormal; a sequence is abnormal if it deviates from most sequences in the set.

The embodiment selects a local abnormal factor recognition algorithm to detect the abnormal pattern of the multivariate time series. The local anomaly factor identification algorithm identifies anomalous patterns by calculating an anomaly score for each pattern. The anomaly score for each mode is related to the k neighbor mode distances for each mode. The MMOD (outlier detection algorithm) for density data estimation is a local anomaly detection algorithm, compared with the LOF (local anomaly detection algorithm) which is widely applied, the MMOD has smaller influence on historical data when the MMOD is expanded online, and the anomaly detection accuracy is higher than that of the LOF. However, the detection accuracy is also affected by the number of neighbors k, so the embodiment improves the MMOD for the problem, adaptively obtains the number of neighbors k based on historical data, and performs online expansion on the number of neighbors k, and provides an online adaptive MMOD abnormal mode detection algorithm, and based on a hidden markov model, realizes online prediction of a multivariate time series abnormal mode.

1.1MMOD anomaly identification algorithm

The MMOD anomaly detection algorithm is a novel anomaly detection algorithm based on local anomaly factors. The algorithm aims at the problem that the traditional local anomaly detection algorithm is high in calculation complexity, and provides a local anomaly detection algorithm based on a density peak value. Different from the traditional density-based anomaly detection algorithm, the local density of each mode is estimated through the kernel function accumulated value of the k neighbor set of each mode, as shown in formula 1:

wherein δ_k(p) is the distance between the mode p and the k-th adjacent mode, the close distance between the modes adopts a Lezhengxin multivariate time sequence mode distance calculation method (firstly compressing the subsequence, then calculating the distance between the compressed subsequences based on DTW), and d (p, x)_i) Is pattern p and its i-th neighbor pattern x_lThe anomaly score of pattern p is calculated by the following formula:

MMOD(p)＝1-M(p) (2)

1.2 Online abnormal pattern recognition algorithm based on MMOD

MMOD is used as a local abnormal factor detection algorithm, and the data density estimation result is greatly influenced by the k value. A normal mode may be identified as an abnormal mode or an abnormal mode may be identified as a normal mode when the k neighbor value of the MMOD is not properly set. Under the condition of no prior knowledge, people are difficult to set a proper k value, and aiming at the problem, the invention provides a self-adaptive MMOD algorithm based on natural neighbors. In consideration of the boundless of the multivariate time sequence, the MMOD algorithm is expanded on line, and the online identification of the multivariate time sequence abnormal mode is realized.

1.2.1 automatic acquisition of k-value based on historical data

In 2016, Jinlong H introduces the concept of natural neighbor, and provides an algorithm based on automatic acquisition of a better k value based on the natural neighbor, so that the problem that a local different factor detection algorithm is not accurate enough due to manual setting of the k neighbor improperly is solved. The idea of natural neighbor is introduced, and the optimal k value of MMOD is obtained based on historical data, so that the optimal k value is configured for MMOD algorithm.

Natural neighbors it is believed that an isolated pattern should have the fewest natural neighbors and a non-isolated pattern with a greater density should have more neighbors. An isolated pattern is defined as a pattern with a natural neighbor number of 0 under the k-neighbor condition. If the number of the isolated modes is kept unchanged in the processes of k neighbor, k +1 neighbor and k +2 neighbor searching, the maximum inverse neighbor number in the k neighbor searching result is the self-adaptive k value of local anomaly. The specific algorithm steps are as follows:

inputting: multiple time series subsequences

And (3) outputting: adaptive k value

Step1 initialization sup_k＝1，nb_i＝0。

Step 2: searching for sub-sequences sup_kNeighbor subsequence, i.e. pattern, and nb_iA natural neighbor subsequence representing the ith subsequence,

the inverse neighbor subsequences of the ith subsequence are stored.

Step2.1: calculating the number of the subsequences with empty natural neighbors and recording the number as

Step2.2: if it is

Go to Step3, otherwise sup_k＝sup_k+1 go to Step2.

Step 3: then k is sup_kMaximum number of inverse neighbors under 2 neighbors, i.e.

1.2.2 Online update of anomaly scores

Assuming that a pattern, i.e., a multi-element time-series subsequence, comes newly at time t, the coming pattern is represented as x for convenience of description_tThe history pattern set is { x_iI ═ 1, L, count }, where count represents all patterns currently stored.

Calculation mode x_tAnd { x in the history pattern set_iDistance of 1, L, count element, | i ═ d (x) is compared_t,x_i) And_k(x_i) If d (x) is large, it can be seen that_t,x_i)＜_k(x_i) Then, mode x is illustrated_iK neighbor set of (2) is changed, and in order to obtain an accurate abnormality score, it is necessary to apply a pattern x_iThe abnormality score of (2) is updated. If the pattern x_tIs a pattern x_iK is close to_k(x_i)＝_k-1(x_i). Let x be_iHas a history k neighbor data set of { x }_ik′If | k' is 1, L, k }, the updated k neighbor dataset is { x |_ik′|k′＝1,L,k-1}∪x_tThen the mode x should be dealt with at this time_iIs abnormal score M (x)_i) Updating is carried out, and the derivation process is as follows:

wherein ,M_old(x_i) Denotes x_tX before arrival_iDensity of (D), M_new(x_i) Denotes x_tX after arrival_iDensity of (k) k N_old(x_i) Is represented by x_tBefore arrival x_iK neighbor pattern set, kNN_new(x_i) Is represented by x_tX after arrival_iK neighbor mode set of (1), then M_new(x_i) And M_old(x_i) The following relationships exist:

as shown in the formula (5), M is_new(x_i) And M_old(x_i) There is no exact magnitude relationship between them. When the new mode x_tAs a history pattern x_iK neighbor mode of (2) will result in x_iK neighbor pattern set of (a) changes, and x is now the same_iAbnormal characteristic M of_new(x_i) Changes will occur requiring x to be re-determined_iAnd correcting the abnormal degree of the abnormal detection result of the historical mode. Therefore, when x_tAs a history pattern x_iIn the k-nearest neighbor mode, d (x) needs to be satisfied for all_t,x_i)＜_k(x_i) History pattern x of_iAnd updating the abnormal score. To avoid history pattern x_iThe k-nearest neighbor distance of each pattern needs to be stored in the repeated calculation of the k-nearest neighbor distance, so that when a new pattern x is used_tOnly x needs to be found when coming_tK neighbor mode of (1) is sufficient.

1.2.3 hidden Markov anomaly detection framework construction

Hidden markov models are statistical models that consider a current hidden state to affect a next hidden state and that the probability of a transition between hidden states does not change over time. If a hidden markov model can be constructed for a pattern sequence having a time series of a plurality of elements, prediction of an abnormal pattern in a time series of a plurality of elements can be realized.

According to the increment fuzzy self-adaptive clustering algorithm, the subsequences of each variable of the multivariate time sequence can be clustered, and the subsequences are classified and symbolized according to the maximum membership principle. It is assumed that observation states having the same time series converge into one class, and different observation states converge into different classes. The conversion of the multivariate time series to the observation series can be achieved by fuzzy clustering. Because the subsequences of each variable can be clustered and symbolized, and the observation state of the subsequence of each variable corresponds to the clustering result, the observation states of a plurality of variable subsequences can jointly represent the observation state of the subsequence of the multivariate time sequence.

Illustrated by an EEG eye state multivariate time series sub-sequence, the EEG eye state dataset comprises three variables AF, F7, FC5, wherein AF is grouped into 3 classes and denoted by the symbol A₀,A₁,A₂Representing class clusters, the time series subsequence corresponding to AF attribute has three observation states, A₀,A₁,A₂Represents; f7 is grouped into 4 classes and symbolized with B₁,B₂,B₃,B₄Then the time series subsequence corresponding to the F7 attribute has four observation states, denoted by B₁,B₂,B₃,B₄Represents; FC5 is grouped into 3 classes and C is symbolized by class₁,C₂,C₃Then the time series subsequence corresponding to the FC5 attribute has three observation states, denoted by C₁,C₂,C₃And (4) showing. The results of the observation states are shown in Table 1.

TABLE 1 EEG eye state observed State

The observation state of each variable subsequence of the multivariate time sequence can be obtained by an increment fuzzy clustering algorithm. While the observed states of the multivariate time series subsequence are collectively characterized by a subsequence of three variables. The EEG eye state is still used as an example for explanation. Since AF3, F7, and FC5 of the EEG eye state include 3, 4, and 3 observation states, respectively, it is known that there are 36 observation states at most 3 × 4 × 3 in the multivariate time series. Where the symbolic representation of the respective variable class index combinations of the first 20 sub-sequences of the EEG eye state data set is represented by table 2, the observed states of the first 20 patterns of the multivariate time series can be represented by table 3.

TABLE 2 EEG eye state Classification results

TABLE 3 EEG eye state observation status

For the multivariate time series abnormal pattern prediction problem, assume that T multivariate time series segments are givenZ₁,Z₂,L,Z_TThen the corresponding observation sequence is O ═ { O ═ O₁,o₂,L,o_T}. For example, the observation sequence corresponding to the first 5 multivariate time series subsequences is { A }₂B₃C₂,A₃B₂C₃,A₁B₁C₁,A₁B₁C₁,A₁B₁C₁And V ═ V of observation state sets of the first 5 observation sequences₁,v₂,v₃And v is₁＝A₂B₃C₂,v₂＝A₃B₂C₃,v₃＝A₁B₁C₁. When a new sequence segment is generated, the observation state corresponding to the segment can be obtained through fuzzy clustering, the observation state may exist in the historical observation state set V or may not exist in the historical observation state set V, and if the observation state does not exist, the newly generated observation state is added into the historical observation state set V. For example, the observed state of the 6 th multivariate time series subsequence is A₁B₄C₁Since it is not in the observation state set V ═ V₁,v₂,v₃In (b), therefore, there is a need for observation state A that will not occur at this time₁B₄C₁Add to historical observation state set V ═ V₁,v₂,v₃In the method, a new observation state set V ═ V is obtained₁,v₂,v₃,v₄And v is₄＝A₁B₄C₁At this time, the observation state sequence is { A }₂B₃C₂,A₃B₂C₃,A₁B₁C₁,A₁B₁C₁,A₁B₁C₁,A₁B₄C₁}。

Given T multivariate time series segments (patterns) Z₁,Z₂,L,Z_TIs that V is { V ═ V }₁,v₂,L,v_MBecause there are only two possible normal or abnormal results for each observation state, each observation state only containsThere are two implicit states (normal and abnormal), then the set of implicit states Q ═ Q corresponding to the multivariate time series pattern₁,L,q_NH (N ═ 2), and q₁＝normal,q₂Abnormal (as shown in equation 7), the following HMM parameter model can be constructed:

λ＝(AA,BB,Π) (6)

Π＝[Π₁(normal),Π₂(abnormal)](7)

wherein AA ═ a_ij](1≤i,j≤N)、BB＝[b_ik](i is more than or equal to 1 and less than or equal to N, and k is more than or equal to 1 and less than or equal to M) are respectively a state transition matrix and an emission matrix. a is_ij＝P[i_t+1＝q_j|i_t＝q_i]For the t-th multivariate time series segment is the implicit state q_iAnd the t +1 th multivariate time series segment is the implicit state q_jProbability of (b)_ik＝P[o_t＝v_k|i_t＝q_i]The hidden state for the t-th multivariate time series segment is q_iAnd the observed state is v_kProbability of (pi) < pi >_i](1. ltoreq. i. ltoreq.N) is an initial hidden state matrix, Π_i＝P[i₁＝q_i]Representing the hidden state of the 1 st multivariate time series segment as q_iThe probability of (c).

HMMs can solve many problems, including the following:

1) evaluating the problem: when both the model and the observation sequence are given, the probability P (O | λ) of the given observation sequence is found.

2) The decoding problem is as follows: given both the model and the observation sequence, the most likely sequence of implicit states is found.

3) Learning problem: in a given case of an observation sequence, a parameter λ that maximizes the output probability P (O | λ) of the observation sequence is sought.

In order to realize the prediction of the abnormal pattern of the multivariate time series, an HMM model needs to be established firstly, and the construction method of the HMM model comprises supervised learning and unsupervised learning. Since only the observation sequence is known, an unsupervised learning algorithm is used herein to estimate the parameters of the HMM model. Two learning methods are described below.

When the sample is labeled data, supervised learning can be performed, and the state transition matrix and the emission matrix are calculated as follows:

wherein |q_iI denotes an initial state of q_iNumber of, | q_ijI indicates that at time t is an implicit state q_iAt time t +1 is an implicit state q_jNumber of, | v_ikI indicates that the observed State is v_kAnd the implicit state is q_iThe number of (2).

When the samples are unlabeled data, the Baum-Welch algorithm is often used to estimate the state transition matrix and the emission matrix, the initial state matrix. Baum-Welch is an algorithm for unsupervised estimation of HMM models.

The observed state sequence is known as O ═ O₁,o₂,L,o_TLet I ═ I }₁,i₂,L,i_TIs an implicit state sequence, then

Is (O, I) ═ O₁,o₂,L,o_T,i₁,i₂,L,i_TOf a log-likelihood function of

wherein

Is an HMM current parameter estimation value.

Then E is solved based on EM algorithm

The following equation is obtained:

m-maximization with EM algorithm

Iteratively estimating AA, BB, Π of the HMM:

assuming that the current parameter value λ of the HMM is known, the probability of the following event occurring can be estimated.

1) The observation states of the first 1, L and t multivariate time series patterns are respectively o₁,o₂,L,o_tAnd the implicit state of the t-th mode is q_iProbability α of_t(i)。

2) The implicit state in the t-th mode is q_iUnder the condition (1), the observation states corresponding to the T +1, L and T modes are respectively o_t+1,o_t+2,L,o_TProbability β of_t(i)。

The calculation formula of the two is as follows:

let ξ_tThe implicit states of (i, j) are the t-th mode and t +1 mode are q_i and q_jThe probability of (d); let gamma be_t(i) For the t-th mode the hidden state is q_iProbability of (2), then ξ_t(i, j) and γ_t(i) Can be calculated by the following formula:

due to the fact that

Then AA, BB, Π can be re-estimated using lagrange multiplier method according to equations 15, 16, as follows:

then a set of parameters for a randomly given HMM model can be known

Order to

Traversing the EM algorithm once can get a set again

Parameter value of (1), order

Then the probability of observing the state can be estimated

Continuously iterating lambda to obtain a stable P (O | lambda), and considering that the model training is completed, usually consideringIs composed of

When the model training is completed, the model training is completed.

The HMM model considers that the current hidden state is only related to the previous hidden state, independent of the past hidden state and the observed state, and the current observed state is independent of the past observed state. The HMM model based on known parameters can predict the next mode hidden state.

Prediction problem of hidden states in the next mode, i.e. given O ═ O₁,o₂,L,o_tUnder the condition, the most probable hidden state sequence I ═ I is obtained₁,i₂,L,i_t,i_t+1}, wherein i_t+1Is the implicit state corresponding to the t +1 th mode. As known from the dynamic programming criterion, the forward solving process needs to satisfy: if the optimal path from the 1 st mode to the t +1 st mode is

Then the path must be guaranteed

Is the optimal path from the 1 st mode to the t-th mode, otherwise

It will not be the optimal path. The Viterbi algorithm seeks an optimal hidden state sequence under the observation state sequence based on a dynamic programming idea, so that the embodiment predicts the multivariate time sequence abnormal pattern based on the Viterbi and the state transition matrix.

The Viterbi algorithm can solve for a given O ═ O₁,o₂,L,o_TThe most likely hidden state sequence I ═ I under the conditions₁,i₂,L,i_T}. Definition of_t(i) For all individual paths i in the t-th mode with an implicit state of i₁,i₂,L,i_tMaximum value of the probability, # of_t(i) For all single paths { i } for the t-th mode with implicit state i₁,i₂,L,i_t-1Probability of i is maximizedThe second to last node of the path, in mathematical form, is as follows:

by_t(i) Is defined by_t+1(i) Can be calculated from the following formula:

then λ ═ (AA, BB, Π) and O ═ O { O ═ are known₁,o₂,L,o_TThen, the maximum probability of the partial path with the T-th mode hidden state i can be searched from T-1 step by step backwards, and when T-T, all possible paths { i } of each hidden state i are obtained₁,i₂,L,i_T-1I }. maximum probability.

The observation sequence o can be obtained by Viterbi algorithm₁,o₂,L,o_tAnd all possible paths i₁,i₂,L,i_t-1Maximum probability of hidden states under i_t(i) I is 1, L, N; t ≧ 1, it can be known that the t +1 th mode hidden state i is in all possible paths { i ≧ 1₁,i₂,L,i_t,i_t+1The maximum probability under is:

then the t +1 th mode is on all possible paths i₁,i₂,L,i_t,i_t+1The most likely implicit state under:

the most likely implicit state for the next mode is

Based on which it is estimated whether the implicit state of the next mode is normal or abnormal.

Since only the observation sequence is known, accurate model parameters AA, BB, Π of the HMM model cannot be obtained, and therefore the Baum-Welch algorithm is used to find the parameter λ with the maximum output probability P (O | λ) given the observation sequence. Taking a mean value when initializing a state transition matrix AA of a historical mode Baum-Welch, initializing an observation state probability matrix BB, and initializing an initial state matrix II by using a detection result of an online MMOD; in the online updating process of the HMM prediction model, if a new observation state is generated, all the current modes are regarded as historical modes, and initialization is carried out according to the initialization methods of the historical modes AA, BB and Π; and if no new observation state is generated, all the modes currently contained are regarded as historical modes, and the current HMM prediction model is initialized by using the HMM prediction model parameters AA, BB and Π before updating. The initialization formula of pi by using the detection result of the online MMOD is as follows:

wherein normalN and abnormalN are the number of normal patterns and abnormal patterns. The specific process of the HMM online prediction model is shown in the flowchart 1.

1.2.4 Algorithm implementation steps

And according to the result of the increment fuzzy self-adaptive clustering, symbolizing the multivariate time sequence segment, wherein each different symbol can be regarded as an observation state of the multivariate time sequence. And realizing the conversion of the multi-element time sequence subsequence to an observation state by an increment fuzzy self-adaptive algorithm. After the initial history pattern is detected by the adaptive MMOD anomaly, information about the anomaly pattern is obtained. Combining the detected historical abnormal mode with the multivariate time series observation state sequence, estimating an initial state matrix pi of the HMM model, then constructing the HMM model by using a Baum-Welch algorithm, and predicting whether the next mode is abnormal or not based on the current observation state sequence and the state transition matrix AA. The method comprises the following specific steps:

step1: and compressing the historical mode, and calculating the distance between any two multivariate time sequences in the compressed historical multivariate time sequences based on a DTW algorithm.

Step 2: the natural k-nearest neighbor of the history pattern is taken as the best k-nearest neighbor value of the online MMOD.

Step 3: and calculating the density estimation abnormal value of each historical mode, judging the size of the density estimation abnormal value and a set threshold value, if the density estimation abnormal value is smaller than the set threshold value, judging the density estimation abnormal value to be normal, and otherwise, judging the density estimation abnormal value to be abnormal.

Step 4: and if a new observation state is generated, initializing an initial state matrix pi of the HMM model by using the current observation sequence and the abnormal mode detection result, obtaining the result of formula (26), randomly assigning BB, and averaging AA, otherwise inheriting AA, pi and BB.

Step4.1: and constructing a hidden Markov model based on the Baum-Welch algorithm and all observation sequences, and turning to Step 5.

Step 5: searching the t-th (the length of the observation sequence is t) mode hidden state i in the observation state sequence of the current multivariate time series mode in all possible paths { i }by using Viterbi₁,i₂,L,i_t-1I } and predicting whether the next mode is abnormal using equation (25) based on the state transition matrix AA.

Step 6: and judging whether a new multivariate time sequence subsequence is generated, if so, estimating a cluster to which the newly generated multivariate time sequence fragment belongs based on the clustering center of the previous data block, and converting the multivariate time sequence subsequence into a corresponding observation state.

Step 7: and calculating the online MMOD abnormal score of the newly generated multi-element time sequence subsequence, updating the abnormal score of the mode in which the k neighbor set changes based on a formula 6, judging whether the current multi-element time sequence subsequence is abnormal based on a threshold value, and turning to Step4.

Experimental verification and result analysis of (II) multivariate time sequence online abnormal pattern recognition and prediction algorithm

And verifying the multivariate time series online abnormal mode prediction algorithm by adopting data of the multivariate time series abnormal data set. Multiple time series abnormal states can be evaluated and further diagnoses made. In order to verify the effectiveness of the algorithm, the algorithm provided by the invention is compared with a multi-element time sequence local anomaly detection algorithm based on LOF and SKLOF.

2.1 introduction to the experiment

In the embodiment, three variables (AF3, F7 and FC5) of an EEG eye state data set are selected to carry out the research of multivariate time series online abnormal pattern recognition and prediction. And identifying abnormal patterns of the historical patterns based on the pattern density of the multivariate time series. And then constructing a hidden Markov prediction model based on the observation state of the historical pattern, the detection state of the historical pattern and Baum-Welch. To illustrate the effectiveness of the algorithm, the detected and predicted results are compared separately to different algorithms in the EEG eye state data set. The multivariate time sequence subsequence is obtained by utilizing an FOSMTS segmentation algorithm, and the observation state is obtained by conversion based on an IFACA fuzzy clustering algorithm.

2.2 offline anomaly Pattern mining

In order to identify historical abnormal patterns, offline abnormal pattern detection is performed by adopting data density estimation based on an adaptive k value. An abnormal pattern diagnostic graph as in fig. 4a is obtained, and for the purpose of visually illustrating the effectiveness of the adaptive density estimation algorithm, an abnormal label of the EEG eye state data set is given in fig. 4b, wherein the region marked with a red ellipse is an abnormal pattern region.

As can be seen from fig. 4a and 4b, when the multivariate time series has abnormal patterns, the abnormal score of the adaptive MMOD algorithm is relatively large, and when the multivariate time series has normal patterns, the abnormal score is relatively low. The method can well separate the normal mode and the abnormal mode and is suitable for identifying the abnormal mode of the multivariate time sequence.

To further illustrate the effectiveness of the proposed algorithm, the adaptive MMOD algorithm test results are compared to the LOF, SKLOF algorithm, whose anomaly diagnosis is shown in FIG. 4 c. As can be seen from fig. 4a and 4d, the anomaly score trends of the adaptive MMOD and LOF are similar in the same mode, but the anomaly score of the LOF algorithm is lower in the last anomaly mode, while the anomaly score of the adaptive MMOD detection algorithm is higher. To further illustrate the effectiveness of the adaptive MMOD algorithm. Table 4 shows the correct number of abnormal patterns detected by the three algorithms, and table 5 shows the accuracy indexes of abnormal pattern detection of the three algorithms, so that it can be seen that the detection accuracy of the abnormal pattern of the adaptive MMOD is the highest, and the detection accuracy of the abnormal pattern of the LOF is the lowest, and the detection accuracy of the abnormal pattern of the SKLOF is higher than the LOF but still lower than the accuracy of the adaptive MMOD algorithm. The mode at the class boundary is not considered by the LOF and the SKLOF, k neighbor modes of the mode are usually in two different classes, the two classes usually have different densities, the k neighbor mode at the low density region can reduce the k neighbor average mode density of the class boundary mode, so that the abnormal score of the boundary mode is increased, the abnormal score of the boundary mode is higher than that of the actual abnormal mode, and the accuracy of abnormal detection is reduced. For more intuitive observation, fig. 4d shows weighted evaluation index F curves of various algorithms, the larger the F value is, the higher the abnormality identification accuracy of the algorithm is, and it can be seen that the F curve of the adaptive MMOD is at the top, so that the adaptive MMOD has the best weighted evaluation quality compared with other algorithms.

TABLE 4 multivariate time series Pattern anomaly detection results

TABLE 5 detection indexes of algorithms

The evaluation index of the algorithm accuracy is usually evaluated by using a weighted evaluation index of a balance accuracy rate PP and a recall rate RR:

where TP is the number of identified patterns as abnormal patterns, FP is the number of identified patterns as non-abnormal patterns, and FN is the number of unrecognized patterns as abnormal patterns.

In order to verify the validity of the adaptive k value, the first 40 patterns, the first 50 patterns and the first 60 patterns of the historical data are taken to form three data sets, and the labels are data set 1, data set 2 and data set 3. Data set 1 will look for four abnormal patterns, data set 2 five abnormal patterns, and data set 3 7 abnormal patterns. Fig. 4f shows the identification accuracy PP curves of the data sets under different k values, and it can be seen from the three data sets that different k values have great influence on the detection result of the abnormal mode identification of the MMOD, and it is very important to find a suitable k value, as shown in fig. 4 e. The optimal k values obtained based on natural neighbors in

data sets

1, 2, 3 are known to be 32, 29, 44, respectively. While the true optimal k-neighbors of

datasets

1, 2 include 32, 29, and the optimal k-neighbors of dataset 3 are 55, 56, 58, which can identify 5 abnormal patterns. From the three data sets, it can be seen that the resulting adaptive k values are optimal in most cases and their recognition accuracy is better than most other k.

2.3 Online Pattern recognition and prediction

And manually setting a multivariate time series abnormal mode threshold, carrying out online abnormal mode identification on subsequent data of the EEG eye state data set based on the threshold, and comparing the threshold with an online LOF (LoF) to explain the effectiveness of the algorithm. The effectiveness of an online LOF algorithm and an online MMOD algorithm is explored from two aspects of anomaly detection effect and the updating number of the multivariate time series anomaly score.

When a new pattern arrives, the neighbor pattern set of the historical patterns may be destroyed, thereby further affecting the anomaly scores of the historical patterns, therefore, when the new pattern arrives, there may be one or more anomaly scores of the historical patterns that need to be updated, table 6 shows the number of historical pattern anomaly scores that need to be updated when two algorithms arrive at patterns 61-72, obviously, when a new multivariate time series segment arrives, the online LOF needs to update the anomaly scores of more historical patterns than the online adaptive MMOD (hereinafter referred to as online MMOD).

The complexity of the algorithm when both find a pattern that updates the anomaly score is simply analyzed below. If the number of patterns included in the pattern set D is N, the complexity of the algorithm in which k neighbor domains change is found to be o (N). If the number of objects with changed k neighbor distances is m, the algorithm complexity of finding the change of the local reachable density is o (mnk), and if the number of the local reachable density changed modes is p, the algorithm complexity of finding other LOF changed modes is o (pnk). The MMOD algorithm only needs to perform the operation of finding that k neighbor of the MMOD algorithm is changed, and the complexity of the MMOD algorithm is O (N). Thus, the online MMOD algorithm can calculate its anomaly score more quickly than the online LOF algorithm, as shown in fig. 4 f.

TABLE 6 multivariate time series new pattern abnormality degree update table

In the present embodiment, the abnormal pattern is mainly recognized, therefore, the present embodiment uses the HMM model to estimate whether the next pattern is abnormal, in order to illustrate the effectiveness of the constructed model, table 7 shows the prediction results of the long and short term memory network (LSTM) and the HMM mode, and displays the part with the correct abnormal prediction in black bold font, fig. 4g shows the prediction result of the HMM, fig. 4h shows the actual abnormal pattern diagram, fig. 4i shows the prediction result of the LSTM, and among the three diagrams, the red part represents the detected abnormal part. Table 8 shows the accuracy PP, the recall RR and the weighted evaluation index F of the two. As can be seen from table 7, the LSTM predicts three anomalies, wherein the number of correctly predicted anomalies is 1 and the number of incorrectly predicted anomalies is 2, while the HMM model predicts three anomalies, wherein the number of correctly predicted anomalies is 2 and the number of incorrectly predicted anomalies is 1, and compared to the LSTM model, the prediction effect of the HMM model is significantly higher than that of the LSTM algorithm. As can be seen from table 8, the prediction accuracy PP, the recall RR, and the weighted evaluation index F of the HMM model are all higher than those of the LSTM model.

TABLE 7 multivariate time series Pattern abnormality prediction results

TABLE 8 prediction accuracy detection indexes by two algorithms

To effectively illustrate the real-time performance of the proposed algorithm, this embodiment compares the online response times of the three combined models, as shown in fig. 4 j. The three combination models include: online MMOD + HMM prediction model, online LOF + HMM prediction, online MMOD + LSTM prediction. It can be obviously seen that the online response time of the online MMOD + HMM prediction model is the shortest, the online response time of the online MMOD + LSTM prediction is the second time, and the online response time of the online MMOD + LSTM prediction is the longest because the LSTM prediction model is introduced, so that the online abnormal mode recognition and prediction response time is increased, and the response speed is reduced. In conclusion, the online MMOD + HMM prediction model has the best online abnormal pattern recognition and prediction real-time performance.

Second embodiment

The embodiment provides a data acquisition and monitoring system based on a cloud platform, as shown in fig. 2; wherein,

the data acquisition system is a supporting system responsible for acquiring data of a plurality of time series abnormal states, C + + is used as a development language, and a plurality of IEC 60870-5 data communication protocols such as 101, 102, 103, 104, Modbus, CDT and DISA are embedded; the modeling meets the requirements of an interface reference model, a Common Information Model (CIM) and a Component Interface Specification (CIS) in IEC 61970, meets the international standard, and can be used as a middleware to be seamlessly integrated with each system; and the access of system data such as a monitoring system, a comprehensive energy management and control system, metering, fault analysis, alarm pushing and the like is realized. The system supports the access of various devices and has the resolving capability of various protocols.

The monitoring system adopts a 2-level architecture, namely a single data acquisition system and a cloud platform centralized monitoring system. The data acquisition system is used for acquiring monitoring data of local multivariate time sequence abnormal states in real time, and realizing local data monitoring, historical data sampling storage and uploading of key real-time data to the cloud platform centralized monitoring system. The cloud platform centralized monitoring system acquires real-time monitoring data from the data acquisition system and is used for monitoring the data condition. The communication protocol between the 2-level systems can adopt an electric power standard IEC104 protocol or other protocols, the real-time data acquisition frequency supports the second level according to the requirements of the protocols, and the modes of variable quantity uploading, circular uploading, calling and the like can be supported.

The main equipment of the data acquisition system comprises a data acquisition front end, a serial server, an industrial personal computer, a display, data acquisition software and the like, the system is controlled through a touch screen, 2 automatic and manual operation modes are provided, and when the system is in the automatic operation mode, a trigger signal can be automatically received to start or stop the system; in the manual mode, the operator may press an operating button to start or stop the system. So as to realize the control of all relevant equipment in the working field of the system. The main elements of the control loop of the electrical equipment adopt international brands such as Schneider and the like, and the stability and reliability of the electrical control of the whole system are ensured.

1. On-site data collection

1) The multivariate time series abnormal data monitoring data interface comprises: a communication interface MB 485;

2) a touch screen;

3) other system data access;

4) and a management server.

2. The data link scheme and the access network structure of the cloud platform are shown in fig. 3;

3. data storage, retrieval, analysis

The data service center uses a real-time historical database to store real-time data of a production process and provide retrieval service, a business SQL database (Oracle or MYSQL) to store static data of a business process and provide retrieval service, and uses an application mode of a big data analysis platform to analyze data in an off-line mode, so that the real-time monitoring requirement of the running state of the photovoltaic building can be supported, and various application-oriented and theme-oriented analysis requirements can be met. The database design organizes the management of the database according to an object-oriented mode which accords with a natural mode of human thinking, realizes a monitoring mode which takes equipment as a unit, is convenient for equipment maintenance and fault diagnosis, and improves the efficiency of data retrieval and search.

The real-time database system is novel database management system software, and is suitable for acquisition, storage, retrieval and release of massive real-time/historical data based on a high-speed database engine developed by a 64-bit system and an advanced distributed cluster architecture, has good horizontal expansion capability and high availability, and can process dynamic data which rapidly changes along with time.

The technical indexes are as follows:

1) scale: the scale of more than 100 ten thousand labels is supported.

2) Speed: high speed, real-time, historical data retrieval capability. Real-time data millisecond-level response; historical data for the monthly span retrieves second-level responses.

3) The storage type is as follows: flexible and diverse multiple data types are supported:

omicron type

Omicron (8/16/32/64)

Omicron floating point type (32 bit/64 bit)

Omicron date type data (time stamp)

Omicron others

4) Efficient data compression:

supporting a plurality of lossless and lossy compression modes, greatly improving the storage efficiency and simultaneously improving the analysis and retrieval speed in mass historical data.

Supporting two-stage compression capacity, effectively improving the utilization rate of network resources, reducing the requirement on hardware, providing multi-stage buffering and improving the high availability of the system.

Supporting the configuration of point granularity, the compression algorithm can be flexibly selected according to the characteristics of different data.

-compression ratios of up to tens of times.

Advanced distributed architecture:

the cluster-based hot backup mechanism enables high availability of data for the system.

The distributed redundant storage architecture enables the system to have high elastic expansion capability.

The disaster recovery mechanism fully ensures high security of production data.

5) Flexible data access interface:

providing a C/C + +/JAVA/JSON interface for third party calling and writing of data.

Third embodiment

The embodiment provides a multivariate time series abnormal data acquisition monitoring system APP, which mainly realizes query and display, online update and modification of relevant information and is convenient for management personnel to monitor in real time. The system mainly comprises a user registration and login module, an online query module, an area display and modification module, a log-out module and the like. Simple and convenient operation and simple and beautiful interface. The system has real-time performance, and registered users can log on the system through the mobile phone APP no matter where the registered users are. The system provides an automatic inquiry function and a display function, and user registration information management capability. The system runs stably and safely for a long time.

The APP is matched with the multivariate time series abnormal data acquisition monitoring system of the invention to form an integral system. The method comprises the steps of using HBuilderX as a development tool, developing by using HTML5+ CSS + JavaScript language, and building APP by using an MUI front-end framework. The APP realizes a registration login function, has the function of inquiring the distribution area of the area data monitoring points, and can load the distribution condition of each area in a map on line and acquire the inflection point coordinates of the area by utilizing the GPS positioning function on the Android mobile phone.

APP platform Components

1) Client terminal

The client uses MUI front-end framework to carry out development and design, and uses HTML5, CSS and JavaScript language to carry out front-end development.

2) Server terminal

The server side is developed by using a ThinkJS server side framework, and is matched with a MySQL database, so that the functions of registration, login verification, data transmission, data addition, data modification and data deletion can be realized.

3) System background management

The system management background is developed by using HTML5, CSS and JavaScript languages and is used for managing the database.

2. Development tool

1) MUI front end framework (based on HTML5, CSS, JavaScript)

2) The method is used for designing and developing Android clients, and HTML5, CSS and JavaScript are also used for developing a system management background.

3) ThinkJS service end frame (based on NodeJS)

The method is used for designing a logic interface to provide service for the client and the system management background so as to realize corresponding functions.

4) Database MySQL

Used for storing the relevant data of the ecological red line and the user information.

Furthermore, it should be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied in the medium.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal to cause a series of operational steps to be performed on the computer or other programmable terminal to produce a computer implemented process such that the instructions which execute on the computer or other programmable terminal provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It should also be noted that the above describes a preferred embodiment of the invention and that while the preferred embodiment of the invention has been described, it will be apparent to those skilled in the art that, once the basic inventive concepts of the present invention have been fully appreciated, numerous modifications and adaptations can be made without departing from the principles of the invention and are intended to be within the scope of the invention. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the embodiments of the invention.

Claims

1.A multivariate time series abnormal pattern prediction method is characterized by comprising the following steps:

2. The multivariate time series abnormal pattern prediction method as claimed in claim 1, wherein the online identification of the multivariate time series abnormal pattern based on the MMOD algorithm comprises:

3. The multivariate time series abnormal pattern prediction method as claimed in claim 2, wherein the on-line prediction of the multivariate time series abnormal pattern based on the constructed hidden markov model comprises the following steps:

4. The multivariate time series abnormal pattern prediction method as claimed in claim 1, wherein the obtaining of the optimal k value of the outlier detection algorithm MMOD estimated from the historical data of the multivariate time series based on the principle of natural neighbors comprises:

s1, initialize sup_k＝1，nb_i＝0；

Storing the inverse neighbor subsequences of the ith subsequenceColumns;

S2.2, if

Go to S3, otherwise sup_k＝sup_k+1 to S2;

s3, determining k as sup_k-²Maximum number of inverse neighbors under a neighbor, i.e.

5. The multivariate time series abnormal pattern prediction method as claimed in claim 1, wherein the MMOD algorithm based on-line identification of the multivariate time series abnormal pattern is realized, further comprising:

6. The multivariate time series abnormal pattern prediction method as claimed in claim 1, wherein the converting of the multivariate time series sub-sequences into the observation sequences is realized according to an incremental fuzzy adaptive clustering algorithm, and the hidden markov model of the multivariate time series is constructed based on the Baum-Welch algorithm and all the observation sequences, and comprises the following steps:

wherein, normalN and abnormalN are the number of normal mode and abnormal mode;

7. The multivariate time series abnormal pattern prediction method as defined in claim 6, wherein the expression of the hidden markov model constructed based on the Baum-Welch algorithm and all observation sequences is as follows:

λ＝(AA,BB,Π)

Π＝[Π₁(normal),Π₂(abnormal)]

8. The multivariate time series abnormal pattern prediction method as defined in claim 7, wherein the on-line prediction of the multivariate time series abnormal pattern based on the constructed hidden Markov model comprises:

9. A data acquisition monitoring device is characterized by comprising a data acquisition module and a cloud platform centralized monitoring module; wherein,

the data acquisition module is used for acquiring monitoring data of local multivariate time series abnormal states in real time, and realizing local data monitoring, historical data sampling storage and uploading of preset real-time data to the cloud platform centralized monitoring system; the monitoring data is obtained by predicting the abnormal state of the local multivariate time series according to the multivariate time series abnormal mode prediction method of any one of claims 1-8;

10. The data collection monitoring device of claim 9, further comprising a data service center;