CN111241158B - Anomaly detection method and device for aircraft telemetry data - Google Patents
Anomaly detection method and device for aircraft telemetry data Download PDFInfo
- Publication number
- CN111241158B CN111241158B CN202010016293.8A CN202010016293A CN111241158B CN 111241158 B CN111241158 B CN 111241158B CN 202010016293 A CN202010016293 A CN 202010016293A CN 111241158 B CN111241158 B CN 111241158B
- Authority
- CN
- China
- Prior art keywords
- data
- node
- telemetering
- detection algorithm
- detection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2474—Sequence data queries, e.g. querying versioned data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/21—Design, administration or maintenance of databases
- G06F16/215—Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/285—Clustering or classification
Abstract
The invention provides an anomaly detection method and device for aircraft telemetering data, which relate to the technical field of data processing and comprise the steps of obtaining pilot telemetering data sent by an aircraft, and determining whether the pilot telemetering data is a stable time sequence or not through stationarity detection; after stationarity detection is finished, acquiring telemetering data of a node at the current time, which is sent by an aircraft; if the pilot telemetering data is a stable time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data; if the pilot telemetering data is not the stationary time sequence, detecting the telemetering data of the node at the current moment by using a preset detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data, so that the technical problems that the detection step for detecting the abnormal data of the telemetering data is complex and the detection accuracy is low in the prior art are solved.
Description
Technical Field
The invention relates to the technical field of data processing, in particular to an anomaly detection method and device for aircraft telemetry data.
Background
For satellite telemetry, the signal acquisition is disturbed by the transient severe change of the space environment and the noise of the equipment line, so that the telemetry data is doped with abnormal data distributed randomly, and the abnormal data brings great difficulty to the development of deep space exploration tasks and space information networks.
In the prior art, algorithms such as a boundary detection algorithm, a trend prediction algorithm, a rate constraint algorithm, a density (distance) detection algorithm and the like are generally adopted to detect the abnormity of the telemetered data, but the detection steps of the method are complex and the detection accuracy is low.
No effective solution has been proposed to the above problems.
Disclosure of Invention
In view of the above, the present invention provides an anomaly detection method and apparatus for aircraft telemetry data, so as to alleviate the technical problems in the prior art that the detection step for performing anomaly data detection on the telemetry data is complex and the detection accuracy is low.
In a first aspect, an embodiment of the present invention provides an anomaly detection method for aircraft telemetry data, including: acquiring pilot telemetering data sent by an aircraft, and determining whether the pilot telemetering data is a stationary time sequence or not through stationary detection; after stationarity detection is finished, acquiring telemetering data of a node at the current time, which is sent by an aircraft; if the pilot telemetering data is a stable time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data; if the pilot telemetering data is not a stationary time sequence, detecting the telemetering data of the current time node by using a preset detection algorithm, and determining whether the telemetering data of the current time node is abnormal data, wherein the preset detection algorithm comprises at least one of the following: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
Further, the method further comprises: and cleaning the abnormal data.
Further, the cleaning of the abnormal data comprises: determining first target data and second target data, wherein the first target data is first normal telemetering data before the node at the current moment, and the second target data is first normal telemetering data after the node at the current moment; calculating a mean value of the first target data and the second target data, and replacing the abnormal data with the mean value.
Further, detecting the telemetry data of the node at the current moment by using a preset detection algorithm, and determining whether the telemetry data of the node at the current moment is abnormal data, including: determining a performance type of the aircraft, wherein the performance type comprises: a first performance type and a second performance type, the in-orbit handling capability of the aircraft of the first performance type being lower than the in-orbit handling capability of the aircraft of the second performance type; determining a target detection algorithm in the preset detection algorithms based on the performance type; and detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data.
Further, determining a target detection algorithm in the preset detection algorithms based on the performance type includes: if the performance type of the aircraft is a first performance type, the target detection algorithm is the three-point set isomorphic mapping detection algorithm; and if the performance type of the aircraft is a second performance type, the target detection algorithm is the left and right double-coset empowerment mapping detection algorithm.
Further, if the target detection algorithm is the three-point set isomorphic mapping detection algorithm; detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data, wherein the method comprises the following steps: determining a neighbor node of the current time node, wherein the neighbor node comprises: the first neighbor node is a neighbor node before the node at the current moment, and the second neighbor node is a neighbor node after the node at the current moment; constructing a first vector line segment by using the current time node and the first neighbor node, constructing a second vector line segment by using the current time node and the second neighbor node, and determining the angle of a vector included angle formed by the first vector line segment and the second vector line segment; and if the angle is smaller than a preset threshold value, the telemetering data of the node at the current moment is abnormal data.
Further, if the target detection algorithm is the left and right double-coset empowerment mapping detection algorithm; detecting the telemetering data by using the target detection algorithm to determine abnormal data in the telemetering data, wherein the method comprises the following steps: constructing a k-element double coset of the node at the current moment; calculating a distance threshold of the k-element double coset, and assigning a node in the k-element double coset to obtain a node assignment; determining a tightness factor comparison threshold value of the node at the current moment; calculating the compactness of the node at the current moment by combining the distance threshold of the k-element double coset and the node assignment;
and if the compactness is smaller than a compactness factor comparison threshold value, the telemetering data of the node at the current moment is abnormal data.
Further, detecting the telemetry data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetry data of the node at the current moment is abnormal data, including: determining whether the telemetry parameters of the telemetry data of the node at the current moment are within a preset boundary range; and if not, the telemetering data of the node at the current moment is abnormal data.
In a second aspect, an embodiment of the present invention further provides an anomaly detection apparatus for aircraft telemetry data, including: the system comprises a first acquisition unit, a second acquisition unit, a first detection unit and a second detection unit, wherein the first acquisition unit is used for acquiring pilot telemetering data sent by an aircraft and determining whether the pilot telemetering data is a stationary time sequence or not through stationarity detection; the second acquisition unit is used for acquiring the telemetering data of the node at the current moment sent by the aircraft after the stationarity detection is finished; the first detection unit is used for detecting the telemetering data of the node at the current moment by using a boundary detection algorithm under the condition that the pilot telemetering data is a stable time sequence, and determining whether the telemetering data of the node at the current moment is abnormal data; the second detection unit is configured to, if the pilot telemetry data is not a stationary time series, detect the telemetry data of the current time node by using a preset detection algorithm, and determine whether the telemetry data of the current time node is abnormal data, where the preset detection algorithm includes at least one of: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
In a third aspect, the present embodiments also provide a computer-readable medium having non-volatile program code executable by a processor, the program code causing the processor to perform the method for anomaly detection of aircraft telemetry data according to the first aspect.
In the embodiment of the invention, firstly, pilot telemetering data sent by an aircraft is obtained, and whether the pilot telemetering data is a stable time sequence is determined through stationarity detection; then, after the stationarity detection is finished, acquiring telemetering data of the node at the current moment, which is sent by the aircraft; if the pilot telemetering data is a stable time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data; if the pilot telemetering data is not a stationary time sequence, detecting the telemetering data of the node at the current moment by using a preset detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data, wherein the preset detection algorithm comprises at least one of the following steps: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
In the embodiment of the invention, stability detection is carried out on the pilot telemetering data to determine whether the pilot telemetering data is a stable time sequence, and different detection algorithms are selected according to the detection result to detect the telemetering data of the node at the current moment, so that whether the telemetering data of the node at the current moment is abnormal data is determined, the purpose of carrying out abnormity detection on the telemetering data is achieved, the technical problems that the detection step for carrying out abnormity detection on the telemetering data is complex and the detection accuracy is low in the prior art are solved, the detection step for detecting the abnormal data of the telemetering data is simplified, and the technical effect of the detection accuracy is improved.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
In order to make the aforementioned and other objects, features and advantages of the present invention comprehensible, preferred embodiments accompanied with figures are described in detail below.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and other drawings can be obtained by those skilled in the art without creative efforts.
FIG. 1 is a flow chart of a method for anomaly detection of aircraft telemetry data according to an embodiment of the present invention;
FIG. 2 is a flow chart of another method for anomaly detection of aircraft telemetry data provided in accordance with an embodiment of the present invention;
FIG. 3 is a flowchart of detecting abnormal data by using a three-point set isomorphic mapping detection algorithm according to an embodiment of the present invention;
fig. 4 is a flowchart of detecting abnormal data by using a left-right double coset empowerment mapping detection algorithm according to an embodiment of the present invention;
fig. 5 is a schematic diagram of an anomaly detection device for aircraft telemetry data according to an embodiment of the present invention.
Detailed Description
To make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings, and it is apparent that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The current anomaly detection method comprises algorithms such as a boundary detection algorithm, a trend prediction algorithm, a rate constraint algorithm, a density (distance) detection algorithm and the like, wherein:
1) and (3) boundary detection algorithm: the boundary detection algorithm is the most widely applied abnormal detection method in satellite tasks, generally aircraft control personnel provide normal boundaries for the work of various telemetering parameters according to samples obtained in a ground test stage and experience of previous satellite tasks, and abnormal data is considered when the data exceed an upper and lower boundary range;
2) and (3) a trend prediction algorithm: because the time series generally has a certain trend, the trend prediction algorithm predicts the subsequent data behaviors and gives a self-adaptive detection boundary by estimating the behavior trend of the time series, and the data is considered to be abnormal data when exceeding the prediction range.
3) And (3) rate constraint algorithm: because the time sequence has a one-dimensional time-varying characteristic, the speed-constraint algorithm cleaning method based on the speed adopts the idea that the speed range (namely the slope) between the front point and the rear point is limited, if the speed is too large, the current point has a metamorphic characteristic, and the current point is considered as abnormal data.
4) Density (distance) detection algorithm: the density (distance) -based anomaly detection algorithm is widely applied to multi-dimensional big data processing, namely a distance threshold value is given, and if the number of neighbors of a certain point in the range is less than a given detection threshold value k, the abnormal data are considered; converted to unit distance, the method is isomorphic to user density detection in a unit space range.
However, the above algorithm has the following disadvantages:
1) and (3) boundary detection algorithm: the method is characterized in that a common boundary detection method is adopted, the detection boundary of each parameter is fixed, only a few extreme mutation data can be found, the method is insensitive to short-term behavior change, an algorithm suitable for local abnormal detection needs to be researched, and when abnormal jump exists in short-term telemetering data, the abnormal jump does not exceed the boundary range, so that the abnormal jump cannot be detected by using the boundary detection algorithm, and the condition of missing detection exists.
2) And (3) a trend detection algorithm: due to the fact that high real-time processing requirements and limited on-orbit resources do not allow long-term observation to obtain statistical rules, the telemetering time sequence often has a non-ideal trend, short-term statistical results are unstable, and a light-weight algorithm based on a small amount of data needs to be researched.
3) Rate detection range: when the time sequence presents a random characteristic, the rate change between the front data and the back data is irregular, the rate jump is too large, the rate detection cannot work normally, and special processing is required according to the type of the telemetering behavior; in addition, the rate detection boundary is also fixed, and for the possibility of misjudgment of normal data with short-term rate exceeding the boundary, an algorithm suitable for local anomaly detection needs to be researched.
4) Density (distance) detection algorithm: the traditional density (distance) based algorithm does not consider the influence of the pre-and-post sequence weight on the evaluation of the closeness degree of the current point, and for a time-varying source, although the pre-and-post data have a certain correlation, the correlation is weaker and weaker along with the increase of the interval time. If such an effect is ignored, the abnormal point value is equivalent to the data value at a later time, so that misjudgment may occur, and an algorithm conforming to the time series correlation characteristic needs to be researched.
The following examples are presented to address the above determinations, and the specific examples are illustrated below:
the first embodiment is as follows:
in accordance with an embodiment of the present invention, there is provided an embodiment of a method for anomaly detection of aircraft telemetry data, it being noted that the steps illustrated in the flowchart of the drawings may be performed in a computer system such as a set of computer-executable instructions and that while a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order different than that presented herein.
FIG. 1 is a flow chart of a method for anomaly detection of aircraft telemetry data according to an embodiment of the present invention, as shown in FIG. 1, including the steps of:
step S102, acquiring pilot telemetering data sent by an aircraft, and determining whether the pilot telemetering data is a stationary time sequence or not through stationarity detection;
it should be noted that the pilot telemetry data is obtained before the current time node, and the data volume of the pilot telemetry data is small, so that whether the pilot telemetry data is a stationary time sequence can be conveniently determined.
Step S104, after the stationarity detection is finished, acquiring telemetering data of the node at the current moment, which is sent by the aircraft;
step S106, if the pilot telemetering data is a stationary time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data;
specifically, the step of detecting the telemetry data of the node at the current time by using a boundary detection algorithm is as follows:
and determining whether the telemetering parameters of the telemetering data of the node at the current moment are within a preset boundary range, and if the telemetering parameters of the telemetering data of the node at the current moment are not within the preset boundary range, determining that the telemetering data of the node at the current moment are abnormal data.
Step S108, if the pilot telemetering data is not a stationary time sequence, detecting the telemetering data of the node at the current moment by using a preset detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data, wherein the preset detection algorithm comprises at least one of the following: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
In the embodiment of the invention, stability detection is carried out on the pilot telemetering data to determine whether the pilot telemetering data is a stable time sequence, and different detection algorithms are selected according to the detection result to detect the telemetering data of the node at the current moment, so that whether the telemetering data of the node at the current moment is abnormal data is determined, the purpose of carrying out abnormity detection on the telemetering data is achieved, the technical problems that the detection step for carrying out abnormity detection on the telemetering data is complex and the detection accuracy is low in the prior art are solved, the detection step for detecting the abnormal data of the telemetering data is simplified, and the technical effect of the detection accuracy is improved.
In the embodiment of the present invention, as shown in fig. 2, the method further includes the following steps:
and step S110, cleaning the abnormal data.
In the embodiment of the present invention, after it is detected that telemetry data of a node at a current time is abnormal data, it is first determined that the first target data is first normal telemetry data (i.e., first target data) before the node at the current time, and the second target data is first normal telemetry data (i.e., second target data) after the node at the current time.
Then, the average value of the first target data and the second target data is solved, and then the average value is used for replacing the abnormal data, so that the technical effect of cleaning the abnormal data is achieved.
By cleaning abnormal data, the accuracy of the telemetering data is improved, the cleaned telemetering data is used as input data of subsequent feature extraction and elastic compression, and technical support can be provided for the development of deep space exploration tasks and spatial information networks.
In this embodiment of the present invention, step S108 further includes the following steps:
step S11, determining the performance type of the aircraft, wherein the performance type comprises: a first performance type and a second performance type, the in-orbit handling capability of the aircraft of the first performance type being lower than the in-orbit handling capability of the aircraft of the second performance type;
step S12, determining a target detection algorithm in the preset detection algorithms based on the performance type;
step S13, detecting the telemetry data of the current time node by using the target detection algorithm, and determining whether the telemetry data of the current time node is abnormal data.
In the embodiment of the invention, in order to simplify the detection steps of abnormal data detection and improve the detection accuracy, when abnormal data is detected, firstly, the performance type of an aircraft sending the telemetering data of the node at the current moment needs to be determined, and a corresponding abnormal data detection algorithm is selected according to the performance type to detect the telemetering data of the node at the current moment.
And if the on-orbit processing capability of the aircraft is weak, detecting the telemetering data of the node at the current moment by adopting a three-point set isomorphic mapping detection algorithm.
And if the on-orbit processing capability of the aircraft is stronger, detecting the telemetering data of the node at the current moment by adopting a left and right double-coset empowerment mapping detection algorithm.
In the embodiment of the present invention, as shown in fig. 3, the detecting abnormal data by using the three-point set isomorphic mapping detection algorithm includes the following steps:
step S21, determining a neighboring node of the current time node, where the neighboring node includes: the first neighbor node is a neighbor node before the node at the current moment, and the second neighbor node is a neighbor node after the node at the current moment;
step S22, constructing a first vector line segment by using the current time node and the first neighbor node, constructing a second vector line segment by using the current time node and the second neighbor node, and determining the angle of a vector included angle formed by the first vector line segment and the second vector line segment;
step S23, if the angle is smaller than a preset threshold, the telemetry data of the current time node is abnormal data.
In the embodiment of the present invention, as shown in fig. 4, the detecting abnormal data by using the left and right double coset empowerment mapping detection algorithm includes the following steps:
step S31, constructing a k-element double coset of the node at the current time;
step S32, calculating a distance threshold of the k-element double coset, and assigning nodes in the k-element double coset to obtain node assignments;
step S33, determining a tightness factor ratio threshold of the current time node;
step S34, calculating the closeness of the node at the current moment by combining the distance threshold of the k-element double coset and the node assignment;
step S35, if the closeness is smaller than the closeness factor comparison threshold, the telemetry data of the node at the current time is abnormal data.
The following describes the detection process of the above two detection algorithms in detail with reference to fig. 3 and 4:
firstly, detecting abnormal data by using a three-point set isomorphic mapping detection algorithm:
from the assumption of smooth linearity of local three-point data and the 3 σ principle, normal data should not deviate from the 3-fold subset internal differential mean of the theoretical value (i.e., the preset threshold is 72 °).
First, it is necessary to determine a neighbor node before the current time node (i.e., a first neighbor node) and determine a neighbor node after the current time node (i.e., a second neighbor node).
And then, connecting the current time node with the first neighbor node, constructing a first vector line segment, and linking the current time node with a second vector line segment constructed by the second neighbor node, thereby forming a vector included angle.
Then, the angle of the vector included angle is determined, and if the angle is smaller than 72 degrees, the telemetering data of the node at the current moment is abnormal data.
If the angle is larger than 72 degrees, the telemetering data of the node at the current moment is normal data.
Secondly, detecting abnormal data by using a left and right double-coset empowerment mapping detection algorithm:
and 1, constructing a left/right k-element double coset of the node at the current moment, wherein k is a positive integer.
2, calculating a distance threshold D of the left cosetlDistance threshold D of right cosetrThe specific calculation is as follows:
3, exponentiating each time node in the left/right cosets in power according to the near-far effect (α)l,αr) Mapping the characteristic weight to the current time node, and assigning a weight value, p, to each time nodej＝(αl)j，pi＝(αr)iNamely: time nodes that are close in time have a higher weight and time nodes that are far away in time have a lower weight (i.e., near-far effect).
And 4, determining a tightness factor comparison threshold T of the current time node, wherein the value of T depends on the number of abnormal data possibly existing in the neighborhood range of the previous time node, when the number of the abnormal data is 1, T is 1/2, when the number of the abnormal data is 2, T is 1/2+1/4, and so on. The number of abnormal data is typically defaulted to 1, i.e., T1/2.
At a distance threshold (D)l,Dr) Summing the left and right cosegregation weights in the range to obtain a compact factor C (k, D)l,Dr) I.e. counting the distance x from the current point in the front and back 2k point data setsnThe sum of the weights with the 1-norm not greater than the distance threshold is used as a tightness measure index 'tightness factor', and is shown as the following formula:
and calculating the compactness of the node at the current moment according to the formula.
And 6, if the compactness is less than the compactness factor comparison threshold T, the telemetering data of the node at the current moment is abnormal data, and if the compactness is greater than or equal to the compactness factor comparison threshold T, the telemetering data of the node at the current moment is normal data.
Example two:
the invention also provides an embodiment of the anomaly detection device for the telemetric data of the aircraft, which is used for executing the anomaly detection method for the telemetric data provided by the embodiment of the invention.
As shown in fig. 5, the telemetry data abnormality detection apparatus includes: a first acquisition unit 10, a second acquisition unit 20, a first detection unit 30 and a second detection unit 40.
The first obtaining unit 10 is configured to obtain pilot telemetry data sent by an aircraft, and determine whether the pilot telemetry data is a stationary time sequence through stationarity detection;
the second obtaining unit 20 is configured to obtain telemetry data of the node at the current time sent by the aircraft after the stationarity detection is completed;
the first detection unit 30 is configured to, when the pilot telemetry data is a stationary time sequence, detect telemetry data of a current time node by using a boundary detection algorithm, and determine whether the telemetry data of the current time node is abnormal data;
the second detection unit 40 is configured to, if the pilot telemetry data is not a stationary time series, detect the telemetry data of the current time node by using a preset detection algorithm, and determine whether the telemetry data of the current time node is abnormal data, where the preset detection algorithm includes at least one of: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
In the embodiment of the invention, stability detection is carried out on the pilot telemetering data to determine whether the pilot telemetering data is a stable time sequence, and different detection algorithms are selected according to the detection result to detect the telemetering data of the node at the current moment, so that whether the telemetering data of the node at the current moment is abnormal data is determined, the purpose of carrying out abnormity detection on the telemetering data is achieved, the technical problems that the detection step for carrying out abnormity detection on the telemetering data is complex and the detection accuracy is low in the prior art are solved, the detection step for detecting the abnormal data of the telemetering data is simplified, and the technical effect of the detection accuracy is improved.
Preferably, the apparatus further comprises: and the data cleaning unit is used for cleaning the abnormal data.
Preferably, the data cleansing unit is configured to: determining first target data and second target data, wherein the first target data is first normal telemetering data before the node at the current moment, and the second target data is first normal telemetering data after the node at the current moment; calculating a mean value of the first target data and the second target data, and replacing the abnormal data with the mean value.
Preferably, the second detection unit is configured to: determining a performance type of the aircraft, wherein the performance type comprises: a first performance type and a second performance type, the in-orbit handling capability of the aircraft of the first performance type being lower than the in-orbit handling capability of the aircraft of the second performance type; determining a target detection algorithm in the preset detection algorithms based on the performance type; and detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data.
Preferably, the second detection unit is configured to: if the performance type of the aircraft is a first performance type, the target detection algorithm is the three-point set isomorphic mapping detection algorithm; and if the performance type of the aircraft is a second performance type, the target detection algorithm is the left and right double-coset empowerment mapping detection algorithm.
Preferably, if the target detection algorithm is the three-point set isomorphic mapping detection algorithm, the second detection unit is configured to: determining a neighbor node of the current time node, wherein the neighbor node comprises: the first neighbor node is a neighbor node before the node at the current moment, and the second neighbor node is a neighbor node after the node at the current moment; constructing a first vector line segment by using the current time node and the first neighbor node, constructing a second vector line segment by using the current time node and the second neighbor node, and determining the angle of a vector included angle formed by the first vector line segment and the second vector line segment; and if the angle is smaller than a preset threshold value, the telemetering data of the node at the current moment is abnormal data.
Preferably, if the target detection algorithm is the left and right double-coset empowerment mapping detection algorithm, the second detection unit is configured to: constructing a k-element double coset of the node at the current moment; calculating a distance threshold of the k-element double coset, and assigning a node in the k-element double coset to obtain a node assignment; determining a tightness factor comparison threshold value of the node at the current moment; calculating the compactness of the node at the current moment by combining the distance threshold of the k-element double coset and the node assignment; and if the compactness is smaller than a compactness factor comparison threshold value, the telemetering data of the node at the current moment is abnormal data.
Preferably, the first detection unit is configured to: determining whether the telemetry parameters of the telemetry data of the node at the current moment are within a preset boundary range; and if not, the telemetering data of the node at the current moment is abnormal data.
The present embodiments also provide a computer readable medium having non-volatile program code executable by a processor, the program code causing the processor to perform the method for anomaly detection of aircraft telemetry data as described in the first embodiment.
In addition, in the description of the embodiments of the present invention, unless otherwise explicitly specified or limited, the terms "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood in specific cases to those skilled in the art.
In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, and are only for convenience of description and simplicity of description, but do not indicate or imply that the device or element being referred to must have a particular orientation, be constructed and operated in a particular orientation, and thus, should not be construed as limiting the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.
Finally, it should be noted that: the above-mentioned embodiments are only specific embodiments of the present invention, which are used for illustrating the technical solutions of the present invention and not for limiting the same, and the protection scope of the present invention is not limited thereto, although the present invention is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: any person skilled in the art can modify or easily conceive the technical solutions described in the foregoing embodiments or equivalent substitutes for some technical features within the technical scope of the present disclosure; such modifications, changes or substitutions do not depart from the spirit and scope of the embodiments of the present invention, and they should be construed as being included therein. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (10)
1. A method of anomaly detection of aircraft telemetry data, comprising:
acquiring pilot telemetering data sent by an aircraft, and determining whether the pilot telemetering data is a stationary time sequence or not through stationary detection, wherein the pilot telemetering data is telemetering data of the aircraft before a current time node;
after stationarity detection is finished, acquiring telemetering data of a node at the current time, which is sent by an aircraft;
if the pilot telemetering data is a stable time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data;
if the pilot telemetering data is not a stationary time sequence, detecting the telemetering data of the current time node by using a preset detection algorithm, and determining whether the telemetering data of the current time node is abnormal data, wherein the preset detection algorithm comprises at least one of the following: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
2. The method of claim 1, further comprising:
and cleaning the abnormal data.
3. The method of claim 2, wherein cleansing the anomaly data comprises:
determining first target data and second target data, wherein the first target data is first normal telemetering data before the node at the current moment, and the second target data is first normal telemetering data after the node at the current moment;
calculating a mean value of the first target data and the second target data, and replacing the abnormal data with the mean value.
4. The method of claim 1, wherein detecting the telemetry data of the current time node by using a preset detection algorithm to determine whether the telemetry data of the current time node is abnormal data comprises:
determining a performance type of the aircraft, wherein the performance type comprises: a first performance type and a second performance type, the in-orbit handling capability of the aircraft of the first performance type being lower than the in-orbit handling capability of the aircraft of the second performance type;
determining a target detection algorithm in the preset detection algorithms based on the performance type;
and detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data.
5. The method of claim 4, wherein determining a target detection algorithm of the predetermined detection algorithms based on the performance type comprises:
if the performance type of the aircraft is a first performance type, the target detection algorithm is the three-point set isomorphic mapping detection algorithm;
and if the performance type of the aircraft is a second performance type, the target detection algorithm is the left and right double-coset empowerment mapping detection algorithm.
6. The method of claim 5, wherein if the target detection algorithm is the three-point set isomorphic mapping detection algorithm;
detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data, wherein the method comprises the following steps:
determining a neighbor node of the current time node, wherein the neighbor node comprises: the first neighbor node is a neighbor node before the node at the current moment, and the second neighbor node is a neighbor node after the node at the current moment;
constructing a first vector line segment by using the current time node and the first neighbor node, constructing a second vector line segment by using the current time node and the second neighbor node, and determining the angle of a vector included angle formed by the first vector line segment and the second vector line segment;
and if the angle is smaller than a preset threshold value, the telemetering data of the node at the current moment is abnormal data.
7. The method according to claim 5, wherein if the target detection algorithm is the left-right double coset empowerment mapping detection algorithm;
detecting the telemetering data by using the target detection algorithm to determine abnormal data in the telemetering data, wherein the method comprises the following steps:
constructing a k-element double coset of the node at the current moment;
calculating a distance threshold of the k-element double coset, and assigning a node in the k-element double coset to obtain a node assignment;
determining a tightness factor comparison threshold value of the node at the current moment;
calculating the compactness of the node at the current moment by combining the distance threshold of the k-element double coset and the node assignment;
and if the compactness is smaller than the compactness factor comparison threshold, the telemetering data of the node at the current moment is abnormal data.
8. The method of claim 1, wherein detecting telemetry data of a node at a current time using a boundary detection algorithm to determine whether the telemetry data of the node at the current time is abnormal data comprises:
determining whether the telemetry parameters of the telemetry data of the node at the current moment are within a preset boundary range;
and if not, the telemetering data of the node at the current moment is abnormal data.
9. An anomaly detection device for aircraft telemetry data, comprising: a first acquisition unit, a second acquisition unit, a first detection unit and a second detection unit, wherein,
the first acquisition unit is used for acquiring pilot telemetering data sent by an aircraft and determining whether the pilot telemetering data is a stationary time sequence or not through stationarity detection, wherein the pilot telemetering data is telemetering data of the aircraft before a current time node;
the second acquisition unit is used for acquiring the telemetering data of the node at the current moment sent by the aircraft after the stationarity detection is finished;
the first detection unit is used for detecting the telemetering data of the node at the current moment by using a boundary detection algorithm under the condition that the pilot telemetering data is a stable time sequence, and determining whether the telemetering data of the node at the current moment is abnormal data;
the second detection unit is configured to, if the pilot telemetry data is not a stationary time series, detect the telemetry data of the current time node by using a preset detection algorithm, and determine whether the telemetry data of the current time node is abnormal data, where the preset detection algorithm includes at least one of: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.
10. A computer-readable medium having non-volatile program code executable by a processor, the program code causing the processor to perform the method of anomaly detection of aircraft telemetry data as claimed in any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010016293.8A CN111241158B (en) | 2020-01-07 | 2020-01-07 | Anomaly detection method and device for aircraft telemetry data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010016293.8A CN111241158B (en) | 2020-01-07 | 2020-01-07 | Anomaly detection method and device for aircraft telemetry data |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111241158A CN111241158A (en) | 2020-06-05 |
| CN111241158B true CN111241158B (en) | 2020-09-18 |
Family
ID=70877672
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010016293.8A Active CN111241158B (en) | 2020-01-07 | 2020-01-07 | Anomaly detection method and device for aircraft telemetry data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111241158B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112526559A (en) * | 2020-12-03 | 2021-03-19 | 北京航空航天大学 | System relevance state monitoring method under multi-working-condition |
| CN112506908A (en) * | 2020-12-10 | 2021-03-16 | 云南电网有限责任公司玉溪供电局 | Electric energy metering data cleaning method and system |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102928655A (en) * | 2012-11-26 | 2013-02-13 | 慈溪市供电局 | Method for detecting power abnormal data |
| CN103646167A (en) * | 2013-11-22 | 2014-03-19 | 北京空间飞行器总体设计部 | Satellite abnormal condition detection system based on telemeasuring data |
| CN104899327A (en) * | 2015-06-24 | 2015-09-09 | 哈尔滨工业大学 | Method for detecting abnormal time sequence without class label |
| CN104915846A (en) * | 2015-06-18 | 2015-09-16 | 北京京东尚科信息技术有限公司 | Electronic commerce time sequence data anomaly detection method and system |
| CN106055919A (en) * | 2016-08-09 | 2016-10-26 | 航天东方红卫星有限公司 | Satellite abnormity detection method based on telemetry data wavelet transformation |
| US10073753B2 (en) * | 2016-02-14 | 2018-09-11 | Dell Products, Lp | System and method to assess information handling system health and resource utilization |
| CN110460622A (en) * | 2019-09-12 | 2019-11-15 | 贵州电网有限责任公司 | A kind of network anomaly detection method based on Situation Awareness prediction technique |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103793765B (en) * | 2014-02-12 | 2017-09-29 | 航天东方红卫星有限公司 | A kind of satellite telemetering data Forecasting Methodology based on Kalman filter |
-
2020
- 2020-01-07 CN CN202010016293.8A patent/CN111241158B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102928655A (en) * | 2012-11-26 | 2013-02-13 | 慈溪市供电局 | Method for detecting power abnormal data |
| CN103646167A (en) * | 2013-11-22 | 2014-03-19 | 北京空间飞行器总体设计部 | Satellite abnormal condition detection system based on telemeasuring data |
| CN104915846A (en) * | 2015-06-18 | 2015-09-16 | 北京京东尚科信息技术有限公司 | Electronic commerce time sequence data anomaly detection method and system |
| CN104899327A (en) * | 2015-06-24 | 2015-09-09 | 哈尔滨工业大学 | Method for detecting abnormal time sequence without class label |
| US10073753B2 (en) * | 2016-02-14 | 2018-09-11 | Dell Products, Lp | System and method to assess information handling system health and resource utilization |
| CN106055919A (en) * | 2016-08-09 | 2016-10-26 | 航天东方红卫星有限公司 | Satellite abnormity detection method based on telemetry data wavelet transformation |
| CN110460622A (en) * | 2019-09-12 | 2019-11-15 | 贵州电网有限责任公司 | A kind of network anomaly detection method based on Situation Awareness prediction technique |
Non-Patent Citations (4)
| Title |
|---|
| Anomaly detection of orbit satellite telemetry sequence based on two-window mode;Du Ying 等;《The 30th Chinese Control and Decision Conference》;20180709;第1064-1068页 * |
| Telemetry fault detection for meteorological satellite based on PCA;Yi Peng 等;《International Symposium on Communications and Information Technologies》;20161124;第357-361页 * |
| 基于遥测数据相关性的航天器异常检测;杨甲森;《仪器仪表学报》;20180819;第39卷(第8期);第24-33页 * |
| 航天器遥测数据异常检测综述;彭喜元 等;《仪器仪表学报》;20160915;第37卷(第9期);第1929-1945页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111241158A (en) | 2020-06-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP7010641B2 (en) | Abnormality diagnosis method and abnormality diagnosis device | |
| CN110839016B (en) | Abnormal flow monitoring method, device, equipment and storage medium | |
| US20180007578A1 (en) | Machine-to-Machine Anomaly Detection | |
| CN111241158B (en) | Anomaly detection method and device for aircraft telemetry data | |
| WO2021126489A1 (en) | Detecting anomalous network activity | |
| WO2017087440A1 (en) | Anomaly fusion on temporal casuality graphs | |
| JP5437328B2 (en) | Observation value reliability evaluation apparatus, observation value reliability evaluation method, and observation value reliability evaluation program | |
| CN110392046B (en) | Method and device for detecting abnormity of network access | |
| CN112364351B (en) | Device threat discovery method, device, computing device and storage medium | |
| Karthik et al. | Data trust model for event detection in wireless sensor networks using data correlation techniques | |
| CN108173672A (en) | The method and apparatus for detecting failure | |
| US8255185B2 (en) | Automated information technology management | |
| Ou et al. | Design and implementation of anomaly condition detection in agricultural IoT platform system | |
| CN110502432B (en) | Intelligent test method, device, equipment and readable storage medium | |
| US11748321B2 (en) | Time-series data condensation and graphical signature analysis | |
| CN104881436B (en) | A kind of electric power communication device method for analyzing performance and device based on big data | |
| CN108376125B (en) | Seismic intensity evaluation method and device | |
| CN113191074A (en) | Machine room power supply parameter detection method for data center | |
| CN110222241B (en) | Community segmentation method and device | |
| Lo et al. | Reference-free detection of spike faults in wireless sensor networks | |
| JP6858798B2 (en) | Feature generator, feature generator and program | |
| CN114679335A (en) | Network security risk assessment training and assessment method and equipment for power monitoring system | |
| CN110098983B (en) | Abnormal flow detection method and device | |
| CN113821316A (en) | Abnormal process detection method and device, storage medium and electronic equipment | |
| JP7325557B2 (en) | Abnormality diagnosis method and abnormality diagnosis device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |