CN113780238A

CN113780238A - Multi-index time sequence signal abnormity detection method and device and electronic equipment

Info

Publication number: CN113780238A
Application number: CN202111136357.9A
Authority: CN
Inventors: 张静; 李泽州; 张宪波; 王超
Original assignee: Jingdong Technology Information Technology Co Ltd
Current assignee: Jingdong Technology Information Technology Co Ltd
Priority date: 2021-09-27
Filing date: 2021-09-27
Publication date: 2021-12-10
Anticipated expiration: 2041-09-27
Also published as: CN113780238B

Abstract

The application provides a method and a device for detecting abnormity of a multi-index time sequence signal and electronic equipment, wherein the method comprises the following steps: determining an image sequence to be processed, wherein the image sequence comprises: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images; extracting index trend characteristics and index correlation characteristics of the plurality of images respectively to generate a characteristic sequence corresponding to the image sequence; and determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence, wherein the considered characteristics are complete, the abnormality detection accuracy is high, and the abnormality detection efficiency is high.

Description

Multi-index time sequence signal abnormity detection method and device and electronic equipment

Technical Field

The present disclosure relates to the field of data processing technologies, and in particular, to a method and an apparatus for detecting an abnormality of a multi-index time sequence signal, and an electronic device.

Background

In the related technology, the abnormal detection method of the multi-index time sequence signal mainly comprises the steps of respectively collecting the change trend characteristics of each index; and determining whether the multi-index time sequence signal has abnormity or not based on the change trend characteristics of each index. In the above scheme, the characteristics considered when determining whether the multi-index time sequence signal is abnormal are less, the abnormality detection accuracy is low, and the abnormality detection efficiency is poor.

Disclosure of Invention

The present application is directed to solving, at least to some extent, one of the technical problems in the related art.

The application provides an abnormality detection method and device for a multi-index time sequence signal and electronic equipment, so that the multi-index time sequence signal is subjected to image acquisition in a plurality of time windows respectively to obtain a plurality of images, index trend characteristics and index correlation characteristics are extracted and processed for the plurality of images respectively, and whether the multi-index time sequence signal is abnormal or not is determined based on the extracted characteristics.

An embodiment of a first aspect of the present application provides an anomaly detection method for a multi-index time sequence signal, including:

determining an image sequence to be processed, wherein the image sequence comprises: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images;

extracting index trend characteristics and index correlation characteristics of the plurality of images respectively to generate a characteristic sequence corresponding to the image sequence;

and determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence.

The method for detecting the abnormality of the multi-index time sequence signal according to the embodiment of the application determines an image sequence to be processed, wherein the image sequence comprises: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images; extracting index trend characteristics and index correlation characteristics of the plurality of images respectively to generate a characteristic sequence corresponding to the image sequence; and determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence, wherein the considered characteristics are complete, the abnormality detection accuracy is high, and the abnormality detection efficiency is high.

The embodiment of the second aspect of the present application provides a training method of an anomaly detection joint model, including:

constructing an initial anomaly detection joint model, wherein the anomaly detection joint model comprises the following steps: determining a feature extraction model of a corresponding feature sequence based on an image sequence and a sequence prediction model for carrying out anomaly detection based on the feature sequence;

obtaining training data, wherein the training data comprises: a sequence of sample images and corresponding labels; the sample image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images; the label represents whether the multi-index time sequence signal is abnormal or not;

and performing coefficient adjustment on the feature extraction model and the sequence prediction model in the abnormality detection joint model by taking the sample image sequence as the input of the abnormality detection joint model and the label as the output of the abnormality detection joint model, so as to realize training.

The training method of the anomaly detection combined model in the embodiment of the application obtains training data, wherein the training data comprises: a sequence of sample images and corresponding labels; the sample image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images; the label represents whether the multi-index time sequence signal is abnormal or not; and the sample image sequence is used as the input of the abnormality detection combined model, the label is used as the output of the abnormality detection combined model, the coefficient adjustment is carried out on the feature extraction model and the sequence prediction model in the abnormality detection combined model, the training is realized, and then the abnormality detection is carried out on the multi-index time sequence signal based on the feature extraction model and the sequence prediction model, the considered features are complete, the abnormality detection accuracy is high, and the abnormality detection efficiency is high.

An embodiment of a third aspect of the present application provides an apparatus for detecting an abnormality of a multi-index time-series signal, including:

a first determining module, configured to determine an image sequence to be processed, where the image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images;

the characteristic extraction module is used for respectively extracting index trend characteristics and index correlation characteristics of the plurality of images so as to generate a characteristic sequence corresponding to the image sequence;

and the second determining module is used for determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence.

The anomaly detection device for multi-index time sequence signals of the embodiment of the application determines an image sequence to be processed, wherein the image sequence comprises: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images; extracting index trend characteristics and index correlation characteristics of the plurality of images respectively to generate a characteristic sequence corresponding to the image sequence; and determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence, wherein the considered characteristics are complete, the abnormality detection accuracy is high, and the abnormality detection efficiency is high.

An embodiment of a fourth aspect of the present application provides a training apparatus for an anomaly detection joint model, including:

a building module, configured to build an initial anomaly detection joint model, where the anomaly detection joint model includes: determining a feature extraction model of a corresponding feature sequence based on an image sequence and a sequence prediction model for carrying out anomaly detection based on the feature sequence;

an obtaining module, configured to obtain training data, where the training data includes: a sequence of sample images and corresponding labels; the sample image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images; the label represents whether the multi-index time sequence signal is abnormal or not;

and the training module is used for performing coefficient adjustment on the feature extraction model and the sequence prediction model in the abnormality detection joint model by taking the sample image sequence as the input of the abnormality detection joint model and the label as the output of the abnormality detection joint model, so as to realize training.

The training device of the anomaly detection combined model of the embodiment of the application is characterized in that training data are obtained, wherein the training data comprise: a sequence of sample images and corresponding labels; the sample image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images; the label represents whether the multi-index time sequence signal is abnormal or not; and the sample image sequence is used as the input of the abnormality detection combined model, the label is used as the output of the abnormality detection combined model, the coefficient adjustment is carried out on the feature extraction model and the sequence prediction model in the abnormality detection combined model, the training is realized, and then the abnormality detection is carried out on the multi-index time sequence signal based on the feature extraction model and the sequence prediction model, the considered features are complete, the abnormality detection accuracy is high, and the abnormality detection efficiency is high.

An embodiment of a fifth aspect of the present application provides an electronic device, including: at least one processor; and a memory communicatively coupled to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor, so that the at least one processor can execute the method for detecting the abnormality of the multi-index time-series signal provided in the embodiment of the first aspect of the present application, or the method for training the abnormality detection joint model provided in the embodiment of the second aspect of the present application.

An embodiment of a sixth aspect of the present application provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the method for detecting an anomaly of a multi-index time-series signal provided in the embodiment of the first aspect of the present application, or the method for training an anomaly detection joint model provided in the embodiment of the second aspect of the present application.

Additional aspects and advantages of the present application will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the present application.

Drawings

The foregoing and/or additional aspects and advantages of the present application will become apparent and readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:

fig. 1 is a schematic flowchart illustrating an anomaly detection method for a multi-index timing signal according to an embodiment of the present disclosure;

FIG. 2 is a diagram illustrating a multi-pointer timing signal;

FIG. 3 is a schematic illustration of a plurality of images in an image sequence;

fig. 4 is a schematic flowchart illustrating an anomaly detection method for a multi-index timing signal according to a second embodiment of the present application;

fig. 5 is a schematic flowchart of a training method of an anomaly detection joint model according to a third embodiment of the present application;

FIG. 6 is a schematic view of an attention mechanism model;

fig. 7 is a schematic structural diagram of an abnormality detection apparatus for multi-index timing signals according to a fourth embodiment of the present application;

fig. 8 is a schematic structural diagram of an abnormality detection apparatus for multi-index timing signals according to a fifth embodiment of the present application;

fig. 9 is a schematic structural diagram of an abnormality detection apparatus for multi-index timing signals according to a sixth embodiment of the present application;

fig. 10 is a schematic structural diagram of a training apparatus of an anomaly detection combination model according to a seventh embodiment of the present application;

FIG. 11 illustrates a block diagram of an exemplary computer device suitable for use in implementing embodiments of the present application.

Detailed Description

Reference will now be made in detail to embodiments of the present application, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are exemplary and intended to be used for explaining the present application and should not be construed as limiting the present application.

Therefore, the present application provides a method and an apparatus for detecting an abnormality of a multi-index timing signal, and an electronic device, mainly aiming at the technical problems of low accuracy and poor efficiency of detecting an abnormality of a multi-index timing signal in the related art.

The following describes a method, an apparatus, and an electronic device for detecting an abnormality of a multi-index timing signal according to an embodiment of the present application with reference to the drawings.

Fig. 1 is a flowchart illustrating an abnormality detection method for a multi-index timing signal according to an embodiment of the present disclosure.

The embodiment of the present application is exemplified by the method for detecting an abnormality of a multi-index timing signal being configured in an abnormality detecting device of a multi-index timing signal, and the abnormality detecting device of a multi-index timing signal can be applied to any electronic equipment, so that the electronic equipment can perform an abnormality detecting function of a multi-index timing signal.

The electronic device may be a Personal Computer (PC), a cloud device, a mobile device, and the like, and the mobile device may be a hardware device having various operating systems, touch screens, and/or display screens, such as a mobile phone, a tablet Computer, a personal digital assistant, a wearable device, and an in-vehicle device.

As shown in fig. 1, the method for detecting an abnormality of a multi-index timing signal may include the following steps:

step 101, determining an image sequence to be processed, wherein the image sequence comprises: and respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images.

In the embodiment of the application, the multi-index time sequence signal is a signal obtained by simultaneously acquiring data of a plurality of indexes at an acquisition time point and acquiring a plurality of acquisition time points. In the multi-index time series signal, a plurality of indexes are generally directed to the same object, for example, a vehicle, a robot, or the like. Taking a vehicle as an example, data acquisition is carried out on a plurality of related indexes on the vehicle at the same time, and a multi-index time sequence signal can be generated. FIG. 2 is a diagram of a multi-index timing signal. In fig. 2, each line represents a corresponding index. Fig. 3 is a schematic diagram of a plurality of images in an image sequence.

In the embodiment of the present application, the process of the multi-index timing signal abnormality detecting apparatus executing step 101 may be, for example, determining a length of a time window and a sliding step length of the time window; determining a plurality of time windows according to the length of the time windows and the sliding step length of the time windows; and respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to generate an image sequence.

The selection of the length of the time window needs to ensure that the image can contain a relatively complete variation trend of a plurality of indexes; and ensures that the image can exhibit varying detail of critical parts. The length of the time window can be determined by combining the historical characteristics, the historical variation trend and the like of the multi-index time sequence signal.

The selection of the time window sliding step needs to ensure that the data of each time point in the multi-index time sequence signal is acquired at least once by the image, that is, the data of each time point is used for feature extraction at least once, so as to avoid data omission and false detection caused by the fact that the data of a certain time point or a certain time period is not acquired by the image. The lower limit of the sliding step length of the time window, namely the upper limit of the image acquisition frequency, needs to consider the processing capacity of the electronic equipment where the abnormality detection device of the multi-index time sequence signal is located, and resource waste caused by overlarge data volume is avoided.

For example, when the multi-index timing signal is acquired in seconds, the time window length may be set to 30-60 minutes and the time window sliding step may be 10-30 minutes.

In this embodiment of the present application, the multiple time windows may include: the method comprises a first time window where a time point to be detected is located and a preset number of second time windows before the first time window. The preset number can be determined according to the change trend of the multi-index time sequence signal, the length of the time window, the sliding step length of the time window and the like.

In the embodiment of the application, the anomaly detection of the multi-index time sequence signal is mainly based on the change trend of the signal, so in order to reduce the data processing amount, images acquired when the image acquisition is carried out on the multi-index time sequence signal in a plurality of time windows respectively can be black and white images; alternatively, the acquired image is converted to a black and white image. The black-and-white image has only black-and-white pixels, the pixel dimension is 1, and the single-channel format is represented. Based on black and white images, redundant data can be skimmed, data processing amount is reduced, the abnormal detection speed of the multi-index time sequence signal is increased, and the abnormal detection efficiency is improved.

And 102, extracting index trend characteristics and index correlation characteristics of the plurality of images respectively to generate a characteristic sequence corresponding to the image sequence.

In the embodiment of the application, the index trend feature may include a variation trend feature of a plurality of indexes. The index correlation characteristic is an index correlation characteristic among a plurality of indexes. Wherein the performance of the index-related features, such as trade-off, co-growth, etc.

In one example, the abnormality detection device of the multi-index time series signal performs the process of step 102, for example, the index trend feature in the image is extracted for each of the plurality of images; determining index correlation characteristics among a plurality of indexes in the image according to the change trend characteristics of the plurality of indexes in the index trend characteristics; and generating a feature sequence according to the index trend features and the index correlation features of the plurality of images.

In another example, the multi-index time-series signal abnormality detection apparatus may perform the process of step 102, for example, by sequentially inputting each of the plurality of images into a preset feature extraction model to obtain index trend features and index correlation features of the plurality of images; and generating a feature sequence according to the index trend features and the index correlation features of the plurality of images.

The feature extraction model may be, for example, a Convolutional Neural Network (CNN) model. The CNN model is mainly composed of two convolution modules. Each Convolution module includes a Convolution operation layer (Convolution), a Batch Normalization operation layer (Batch Normalization-BN), a Max Pooling operation layer (Max Pooling-MP), and a drop operation layer (DropOut-DP). The convolution operation layer extracts different hierarchical features through convolution operation of convolution kernels and corresponding position elements in the image. And the batch standardization operation layer performs normalization operation on the input data to accelerate the convergence speed of the model. The maximum pooling operation layer realizes the extraction of effective features while reducing the data volume. The sacrificial operation layer is designed to prevent overfitting.

The last convolution module is connected with a flat operation layer (Flatten) and a full Connection-FC (full Connection-FC), the features extracted by the convolution operation are further abstracted, and meanwhile, the structure transformation is carried out on the input to the subsequent LSTM network, so that the subsequent network processing is facilitated. The tiled operation layer is used for converting the data format output by the convolutional network into a data format which is convenient for operation of the full connection layer. The full-connection layer realizes the feature extraction of the input data through point-by-point calculation.

And 103, determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence.

In the embodiment of the present application, the process of the multi-index time sequence signal abnormality detecting apparatus executing step 103 may be, for example, inputting the characteristic sequence into a preset sequence prediction model to obtain a prediction result output by the sequence prediction model; and determining whether the multi-index time sequence signal is abnormal or not according to the prediction result.

The sequence prediction model may be, for example, a Long Short Term Memory (LSTM) model. The input of the sequence prediction model is a characteristic sequence, and the output prediction result is abnormal probability; and determining whether the multi-index time sequence signal is abnormal or normal according to the abnormal probability. For example, if the abnormal probability is greater than the preset probability value, determining that the multi-index time sequence signal is abnormal; and if the abnormal probability is less than or equal to the preset probability value, determining that the multi-index time sequence signal is normal. As another example, the probability of an anomaly is combined with an excitation function to determine whether the multi-index timing signal has an anomaly.

In the embodiment of the present application, the plurality of time windows include: in the case of the first time window where the time point to be detected is located and a preset number of second time windows before the first time window, the process of the step 103 executed by the abnormality detecting device for a multi-index time series signal may be, for example, to determine whether there is an abnormality in the multi-index time series signal at the time point to be detected according to the feature sequence.

Fig. 4 is a flowchart illustrating an abnormality detection method for a multi-index timing signal according to a second embodiment of the present application.

As shown in fig. 4, the method for detecting an abnormality of a multi-index timing signal may include the following steps:

step 401, determining an image sequence to be processed, wherein the image sequence includes: and respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images.

Step 402, index trend feature and index correlation feature extraction processing are respectively performed on the plurality of images to generate a feature sequence corresponding to the image sequence.

And step 403, determining the correlation between a first feature and each second feature in the feature sequence, wherein the first feature is the feature of the image corresponding to the first time window, and the second feature is the feature of the image corresponding to the second time window.

In the embodiment of the present application, the correlation may be, for example, a euclidean distance between the first feature and the second feature, a cosine similarity between the first feature and the second feature, and the like, and may be set according to actual needs. The smaller the correlation between a certain second feature and the first feature is, the greater the fluctuation degree of the multi-index time series data in the image corresponding to the second feature compared with the multi-index time series data in the image corresponding to the first feature is, that is, the second feature has a greater contribution to the abnormality judgment. The greater the correlation between a certain second feature and the first feature, the smaller the fluctuation degree of the multi-index time series data in the image corresponding to the second feature compared with the multi-index time series data in the image corresponding to the first feature, that is, the smaller the contribution of the second feature to the abnormality judgment.

In the embodiment of the present application, the second feature with a larger contribution may be given a larger weight, and the second feature with a smaller contribution may be given a smaller weight.

And step 404, determining the weight of each second feature according to the correlation.

In this embodiment, the process of step 404 executed by the apparatus for detecting an abnormality of a multi-index timing signal may be, for example, determining a candidate feature, where the candidate feature is a second feature with a minimum corresponding correlation; determining a first part of features and a second part of features in the feature sequence according to the candidate features, wherein the first part of features comprises the second features which are ranked before the candidate features; the second partial feature comprises a candidate feature and a second feature ranked after the candidate feature; determining, for each feature in the first partial feature, a weight of the feature as an initial weight value; and determining the weight of the feature according to the relevance, the relevance and the value of the feature and the initial weight value for each feature in the second part of features.

The initial weight value may be, for example, the inverse number of the number of features in the feature sequence, or the inverse number of the number of images in the image sequence. And the features in the feature sequence correspond to the images in the image sequence one by one.

In the embodiment of the present application, the sum of the correlation degrees of all the second features in the feature sequence may be calculated as the correlation degree sum value; or, calculating the sum of the correlation degrees of all the characteristics in the second part of characteristics as the correlation degree sum value. And calculating the ratio of the relevance of each feature in the second part of features to the sum of the relevance, and taking the sum of the ratio and the initial weight value as the weight of the feature.

In addition, it should be noted that, instead of step 403 and step 404, another way may be to input the feature sequence into a preset attention mechanism model, and determine the weight of each second feature in the feature sequence.

Step 405, adjusting each second feature in the feature sequence according to the weight of each second feature.

In this embodiment of the application, for each second feature in the feature sequence, the second feature may be multiplied by a corresponding weight, and a result obtained by the multiplication is used as the adjusted second feature, so as to obtain an adjusted feature sequence.

And step 406, determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence.

It should be noted that details of step 401, step 402, and step 406 may refer to step 101, step 102, and step 103 in the embodiment shown in fig. 1, and detailed description thereof is omitted here.

The method for detecting the abnormality of the multi-index time sequence signal according to the embodiment of the application determines an image sequence to be processed, wherein the image sequence comprises: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images; extracting index trend characteristics and index correlation characteristics of the plurality of images respectively to generate a characteristic sequence corresponding to the image sequence; determining the correlation degree between a first feature and each second feature in the feature sequence, wherein the first feature is the feature of the image corresponding to the first time window, and the second feature is the feature of the image corresponding to the second time window; determining the weight of each second feature according to the correlation; adjusting each second feature in the feature sequence according to the weight of each second feature; and determining whether the multi-index time sequence signal is abnormal or not according to the characteristic sequence, wherein the considered characteristics are complete, the abnormality detection accuracy is high, and the abnormality detection efficiency is high.

Fig. 5 is a flowchart illustrating a training method of an anomaly detection joint model according to a third embodiment of the present application.

The embodiment of the present application exemplifies that the training method of the anomaly detection joint model is configured in the training apparatus of the anomaly detection joint model, and the training apparatus of the anomaly detection joint model can be applied to any electronic device, so that the electronic device can perform the training function of the anomaly detection joint model.

As shown in fig. 5, the training method of the anomaly detection joint model may include the following steps:

step 501, constructing an initial anomaly detection joint model, wherein the anomaly detection joint model comprises: the image processing device comprises a feature extraction model for determining a corresponding feature sequence based on an image sequence and a sequence prediction model for carrying out anomaly detection based on the feature sequence.

In the embodiment of the present application, the feature extraction model may be, for example, a Convolutional Neural Networks (CNN) model. The model is used for extracting index trend characteristics and index correlation characteristics of a plurality of images in an image sequence respectively to obtain the characteristics of each image, and further generating a characteristic sequence corresponding to the image sequence.

In the embodiment of the present application, the sequence prediction model may be, for example, a Long Short Term Memory (LSTM) model. The input of the sequence prediction model is a characteristic sequence, and the output prediction result is abnormal probability; and determining whether the multi-index time sequence signal is abnormal or normal according to the abnormal probability. For example, if the abnormal probability is greater than the preset probability value, determining that the multi-index time sequence signal is abnormal; and if the abnormal probability is less than or equal to the preset probability value, determining that the multi-index time sequence signal is normal. As another example, the probability of an anomaly is combined with an excitation function to determine whether the multi-index timing signal has an anomaly.

Step 502, obtaining training data, wherein the training data comprises: a sequence of sample images and corresponding labels; the sample image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images; the label represents whether the multi-index time sequence signal is abnormal or not.

In this embodiment of the present application, the process of the training apparatus for the anomaly detection combined model to execute step 502 may be, for example, to determine a length of a time window and a sliding step of the time window; determining a plurality of sample time windows according to the length of the time windows and the sliding step length of the time windows; respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images, and generating a sample image sequence; and repeating the process to determine different sample time windows, and further acquiring a plurality of sample image sequences for training.

And 503, taking the sample image sequence as the input of the abnormality detection joint model, taking the label as the output of the abnormality detection joint model, and performing coefficient adjustment on the feature extraction model and the sequence prediction model in the abnormality detection joint model to realize training.

In the embodiment of the application, a sample image sequence is used as an input of an abnormality detection combined model, a prediction tag (abnormality probability or abnormality) output by the abnormality detection combined model is obtained, and a loss function (cross entropy function and the like) is constructed by combining the prediction tag and a sample tag corresponding to the sample image sequence. And optimizing by using an Adams optimizer, performing back propagation in the sequence prediction model and the feature extraction model according to a chain rule, and adjusting coefficients of the sequence prediction model and the feature extraction model by using a gradient descent method until the descent convergence of the loss function or the accuracy of the abnormal detection combined model meets the requirement.

Further, in the embodiment of the present application, in order to accelerate the model training speed and improve the accuracy of the trained model, the feature adjustment module or the attention mechanism model may be connected after the feature extraction model, and the output of the feature adjustment module or the attention mechanism model may be connected to the sequence prediction model.

The characteristic adjusting module is used for determining the correlation between first characteristics and each second characteristic in the characteristic sequence, wherein the first characteristics are the characteristics of the image corresponding to the first time window, and the second characteristics are the characteristics of the image corresponding to the second time window; determining the weight of each second feature according to the correlation; and adjusting each second feature in the feature sequence according to the weight of each second feature.

The input of the attention mechanism model is a feature sequence, the output can be the weight of each second feature in the feature sequence, and each second feature in the feature sequence is adjusted according to the weight of each second feature.

In the embodiment of the present application, a schematic diagram of an attention mechanism model may be as shown in fig. 6, and fig. 6 is a schematic diagram of an attention mechanism model. In fig. 6, the attention mechanism may determine the weight of each second feature (F1, F2, F3, F4, … …) in the feature sequence, perform product processing with the corresponding second feature to obtain an adjusted second feature, generate an adjusted feature sequence, input the write prediction model, and further obtain the anomaly probability (anomaly score).

In the embodiment of the present application, when the attention mechanism model is connected after the feature extraction model, the training process of the abnormality detection joint model may be, for example, to perform coefficient adjustment on the feature extraction model, the attention mechanism model, and the sequence prediction model in the abnormality detection joint model by using the sample image sequence as an input of the abnormality detection joint model and using the label as an output of the abnormality detection joint model, thereby implementing training.

Fig. 7 is a schematic structural diagram of an abnormality detection apparatus for a multi-index timing signal according to a fourth embodiment of the present application.

As shown in fig. 7, the apparatus 700 for detecting an abnormality of a multi-index timing signal may include: a first determination module 710, a feature extraction module 720, and a second determination module 730.

The first determining module 710 is configured to determine an image sequence to be processed, where the image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of time windows to obtain a plurality of images;

a feature extraction module 720, configured to perform index trend feature and index correlation feature extraction processing on the multiple images respectively to generate a feature sequence corresponding to the image sequence;

a second determining module 730, configured to determine whether there is an abnormality in the multi-index timing signal according to the feature sequence.

Further, in a possible implementation manner of the embodiment of the present application, the first determining module 710 is specifically configured to determine a length of a time window and a sliding step of the time window; determining the plurality of time windows according to the length of the time windows and the sliding step length of the time windows; and respectively carrying out image acquisition on the multi-index time sequence signals in the plurality of time windows to generate the image sequence.

Further, in a possible implementation manner of the embodiment of the present application, the feature extraction module 720 is specifically configured to, for each image of the plurality of images, extract the index trend feature in the image; determining index correlation characteristics among a plurality of indexes in the image according to the change trend characteristics of the plurality of indexes in the index trend characteristics; generating the feature sequence according to the index trend features and the index correlation features of the plurality of images.

Further, in a possible implementation manner of the embodiment of the present application, the feature extraction module 720 is specifically configured to sequentially input each of the plurality of images into a preset feature extraction model, so as to obtain the index trend features and the index correlation features of the plurality of images; generating the feature sequence according to the index trend features and the index correlation features of the plurality of images.

Further, in a possible implementation manner of the embodiment of the present application, the second determining module 730 is specifically configured to input the feature sequence into a preset sequence prediction model to obtain a prediction result output by the sequence prediction model; and determining whether the multi-index time sequence signal is abnormal or not according to the prediction result.

Further, in a possible implementation manner of the embodiment of the present application, the plurality of time windows include: the method comprises a first time window where a time point to be detected is located and a preset number of second time windows before the first time window. With reference to fig. 8 in combination, on the basis of the embodiment shown in fig. 7, the apparatus further includes: a third determination module 740, a fourth determination module 750, and a first adjustment module 760.

The third determining module 740 is configured to determine a correlation between a first feature and each second feature in the feature sequence, where the first feature is a feature of an image corresponding to the first time window, and the second feature is a feature of an image corresponding to the second time window; the fourth determining module 750 is configured to determine the weight of each second feature according to the correlation; the first adjusting module 760 is configured to adjust each second feature in the feature sequence according to the weight of each second feature.

Further, in a possible implementation manner of the embodiment of the present application, the fourth determining module 750 is specifically configured to determine a candidate feature, where the candidate feature is a second feature with a minimum corresponding correlation degree; determining a first partial feature and a second partial feature in the feature sequence according to the candidate feature, wherein the first partial feature comprises a second feature which is ordered before the candidate feature; the second partial feature comprises the candidate feature and a second feature ordered after the candidate feature; determining, for each feature in the first portion of features, a weight of the feature as an initial weight value; for each feature in the second partial feature, determining a weight of the feature according to the relevance, relevance and value of the feature and the initial weight value.

Further, in a possible implementation manner of the embodiment of the present application, the plurality of time windows include: the method comprises a first time window where a time point to be detected is located and a preset number of second time windows before the first time window. With reference to fig. 9 in combination, on the basis of the embodiment shown in fig. 7, the apparatus further includes: a fifth determination module 770 and a second adjustment module 780.

The fifth determining module 770 is configured to input the feature sequence into a preset attention mechanism model, and determine a weight of each second feature in the feature sequence; wherein the second characteristic is a characteristic of an image corresponding to the second time window;

the second adjusting module 780 is configured to adjust the second features in the feature sequence according to the weights of the second features.

It should be noted that the explanation in the first embodiment is also applicable to the apparatus for detecting an abnormality of a multi-index timing signal in the first embodiment, and details are not repeated here.

Fig. 10 is a schematic structural diagram of a training apparatus of an anomaly detection combination model according to a seventh embodiment of the present application.

As shown in fig. 10, the training apparatus 1000 of the anomaly detection combined model may include: a build module 1100, an acquisition module 1200, and a training module 1300.

The constructing module 1100 is configured to construct an initial anomaly detection joint model, where the anomaly detection joint model includes: determining a feature extraction model of a corresponding feature sequence based on an image sequence and a sequence prediction model for carrying out anomaly detection based on the feature sequence;

an obtaining module 1200, configured to obtain training data, where the training data includes: a sequence of sample images and corresponding labels; the sample image sequence includes: respectively carrying out image acquisition on the multi-index time sequence signals in a plurality of sample time windows to obtain a plurality of sample images; the label represents whether the multi-index time sequence signal is abnormal or not;

the training module 1300 is configured to perform coefficient adjustment on the feature extraction model and the sequence prediction model in the anomaly detection joint model by using the sample image sequence as an input of the anomaly detection joint model and using the label as an output of the anomaly detection joint model, so as to implement training.

It should be noted that the explanation in the first embodiment is also applicable to the training apparatus of the anomaly detection joint model in the first embodiment, and details are not repeated here.

In order to implement the above embodiments, the present application also provides an electronic device, including: at least one processor; and a memory communicatively coupled to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method for detecting the abnormality of the multi-index time sequence signal, which is provided by the foregoing embodiment of the present application; alternatively, the foregoing embodiment of the present application provides a training method of an anomaly detection joint model.

In order to achieve the above embodiments, the present application also proposes a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the abnormality detection method of a multi-index time-series signal as proposed in the foregoing embodiments of the present application; alternatively, the foregoing embodiment of the present application provides a training method of an anomaly detection joint model.

FIG. 11 illustrates a block diagram of an exemplary computer device suitable for use in implementing embodiments of the present application. The computer device 12 shown in fig. 11 is only an example, and should not bring any limitation to the function and the scope of use of the embodiments of the present application.

As shown in FIG. 11, computer device 12 is embodied in the form of a general purpose computing device. The components of computer device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components including the system memory 28 and the processing unit 16.

Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. These architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus, to name a few.

Computer device 12 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by computer device 12 and includes both volatile and nonvolatile media, removable and non-removable media.

Memory 28 may include computer system readable media in the form of volatile Memory, such as Random Access Memory (RAM) 30 and/or cache Memory 32. Computer device 12 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 34 may be used to read from and write to non-removable, nonvolatile magnetic media (not shown in FIG. 11, and commonly referred to as a "hard drive"). Although not shown in FIG. 11, a disk drive for reading from and writing to a removable, nonvolatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, nonvolatile optical disk (e.g., a Compact disk Read Only Memory (CD-ROM), a Digital versatile disk Read Only Memory (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to bus 18 by one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the application.

A program/utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which examples or some combination thereof may comprise an implementation of a network environment. Program modules 42 generally perform the functions and/or methodologies of the embodiments described herein.

Computer device 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), with one or more devices that enable a user to interact with computer device 12, and/or with any devices (e.g., network card, modem, etc.) that enable computer device 12 to communicate with one or more other computing devices. Such communication may be through an input/output (I/O) interface 22. Moreover, computer device 12 may also communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public Network such as the Internet) via Network adapter 20. As shown, network adapter 20 communicates with the other modules of computer device 12 via bus 18. It should be understood that although not shown in the figures, other hardware and/or software modules may be used in conjunction with computer device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

The processing unit 16 executes various functional applications and data processing, for example, implementing the methods mentioned in the foregoing embodiments, by executing programs stored in the system memory 28.

In the description herein, reference to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the application. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.

Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present application, "plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.

Any process or method descriptions in flow charts or otherwise described herein may be understood as representing modules, segments, or portions of code which include one or more executable instructions for implementing steps of a custom logic function or process, and alternate implementations are included within the scope of the preferred embodiment of the present application in which functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those reasonably skilled in the art of the present application.

The logic and/or steps represented in the flowcharts or otherwise described herein, e.g., an ordered listing of executable instructions that can be considered to implement logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.

It should be understood that portions of the present application may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, any one or combination of the following techniques, which are known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.

It will be understood by those skilled in the art that all or part of the steps carried by the method for implementing the above embodiments may be implemented by hardware related to instructions of a program, which may be stored in a computer readable storage medium, and when the program is executed, the program includes one or a combination of the steps of the method embodiments.

In addition, functional units in the embodiments of the present application may be integrated into one processing module, or each unit may exist alone physically, or two or more units are integrated into one module. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode. The integrated module, if implemented in the form of a software functional module and sold or used as a stand-alone product, may also be stored in a computer readable storage medium.

The storage medium mentioned above may be a read-only memory, a magnetic or optical disk, etc. Although embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application, and that variations, modifications, substitutions and alterations may be made to the above embodiments by those of ordinary skill in the art within the scope of the present application.

Claims

1. A method for detecting an abnormality of a multi-index time series signal, comprising:

2. The method of claim 1, wherein determining the sequence of images to be processed comprises:

determining the length of a time window and the sliding step length of the time window;

determining the plurality of time windows according to the length of the time windows and the sliding step length of the time windows;

and respectively carrying out image acquisition on the multi-index time sequence signals in the plurality of time windows to generate the image sequence.

3. The method according to claim 1, wherein the performing index trend feature and index correlation feature extraction processing on the plurality of images to generate a feature sequence corresponding to the image sequence comprises:

extracting, for each image of the plurality of images, the indicator trend feature in the image;

determining index correlation characteristics among a plurality of indexes in the image according to the change trend characteristics of the plurality of indexes in the index trend characteristics;

generating the feature sequence according to the index trend features and the index correlation features of the plurality of images.

4. The method according to claim 1, wherein the performing index trend feature and index correlation feature extraction processing on the plurality of images to generate a feature sequence corresponding to the image sequence comprises:

sequentially inputting each image in the plurality of images into a preset feature extraction model to obtain the index trend features and the index correlation features of the plurality of images;

5. The method of claim 1, wherein determining whether an anomaly exists in the multi-index timing signal according to the signature sequence comprises:

inputting the characteristic sequence into a preset sequence prediction model to obtain a prediction result output by the sequence prediction model;

and determining whether the multi-index time sequence signal is abnormal or not according to the prediction result.

6. The method of claim 1 or 5, wherein the plurality of time windows comprises: the method comprises the following steps that a first time window where a time point to be detected is located and a preset number of second time windows before the first time window are arranged;

before determining whether the multi-index time sequence signal has an abnormality according to the characteristic sequence, the method further comprises the following steps:

determining the correlation degree between a first feature and each second feature in the feature sequence, wherein the first feature is the feature of the image corresponding to the first time window, and the second feature is the feature of the image corresponding to the second time window;

determining the weight of each second feature according to the correlation;

and adjusting the second characteristics in the characteristic sequence according to the weight of the second characteristics.

7. The method of claim 6, wherein determining the weight of each second feature according to the correlation comprises:

determining candidate features, wherein the candidate features are second features with the minimum corresponding correlation degree;

determining a first partial feature and a second partial feature in the feature sequence according to the candidate feature, wherein the first partial feature comprises a second feature which is ordered before the candidate feature; the second partial feature comprises the candidate feature and a second feature ordered after the candidate feature;

determining, for each feature in the first portion of features, a weight of the feature as an initial weight value;

for each feature in the second partial feature, determining a weight of the feature according to the relevance, relevance and value of the feature and the initial weight value.

8. The method of claim 1 or 5, wherein the plurality of time windows comprises: the method comprises the following steps that a first time window where a time point to be detected is located and a preset number of second time windows before the first time window are arranged;

inputting the characteristic sequence into a preset attention mechanism model, and determining the weight of each second characteristic in the characteristic sequence; wherein the second characteristic is a characteristic of an image corresponding to the second time window;

9. A training method of an anomaly detection combined model is characterized by comprising the following steps:

10. An abnormality detection device for a multi-index time series signal, comprising:

11. The apparatus of claim 10, wherein the first determining module is specifically configured to,

12. The apparatus of claim 10, wherein the feature extraction module is specifically configured to,

13. The apparatus of claim 10, wherein the feature extraction module is specifically configured to,

14. The apparatus of claim 10, wherein the second determining module is specifically configured to,

15. The apparatus of claim 10 or 14, wherein the plurality of time windows comprises: the method comprises the following steps that a first time window where a time point to be detected is located and a preset number of second time windows before the first time window are arranged; the device further comprises: the device comprises a third determining module, a fourth determining module and a first adjusting module;

the third determining module is configured to determine a correlation between a first feature and each second feature in the feature sequence, where the first feature is a feature of an image corresponding to the first time window, and the second feature is a feature of an image corresponding to the second time window;

the fourth determining module is configured to determine the weight of each second feature according to the correlation;

the first adjusting module is configured to adjust each second feature in the feature sequence according to the weight of each second feature.

16. The apparatus of claim 15, wherein the fourth determining module is specifically configured to,

17. The apparatus of claim 10 or 14, wherein the plurality of time windows comprises: the method comprises the following steps that a first time window where a time point to be detected is located and a preset number of second time windows before the first time window are arranged; the device further comprises: a fifth determining module and a second adjusting module;

the fifth determining module is configured to input the feature sequence into a preset attention mechanism model, and determine a weight of each second feature in the feature sequence; wherein the second characteristic is a characteristic of an image corresponding to the second time window;

the second adjusting module is configured to adjust each second feature in the feature sequence according to the weight of each second feature.

18. An anomaly detection combined model training device, comprising:

19. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-9.

20. A non-transitory computer readable storage medium having stored thereon computer instructions for causing the computer to perform the method of any one of claims 1-9.