CN111858680B - System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time - Google Patents
System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time Download PDFInfo
- Publication number
- CN111858680B CN111858680B CN202010764018.4A CN202010764018A CN111858680B CN 111858680 B CN111858680 B CN 111858680B CN 202010764018 A CN202010764018 A CN 202010764018A CN 111858680 B CN111858680 B CN 111858680B
- Authority
- CN
- China
- Prior art keywords
- data
- abnormal
- statistic
- windows
- current window
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
- G06F16/24568—Data stream processing; Continuous queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/26—Visual data mining; Browsing structured data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2216/00—Indexing scheme relating to additional aspects of information retrieval not explicitly covered by G06F16/00 and subgroups
- G06F2216/03—Data mining
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Computation (AREA)
- Evolutionary Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Computational Biology (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computational Linguistics (AREA)
- Radio Relay Systems (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The invention provides a method for rapidly detecting the abnormality of satellite telemetering time sequence data in real time, which is suitable for the telemetering time sequence data of satellite component parameters. The method of the invention uses the sliding window to carry out the subsection processing on the telemetering data stream, and the data of each window is compared with the first k windows, thereby having self-adaptability and needing no manual setting of fixed upper and lower parameter limits. The method analyzes data from multiple angles of time domain and frequency domain, and integrates four real-time anomaly detection technologies, including time domain statistic anomaly detection, time domain first-order derivative anomaly detection, frequency domain similarity anomaly detection and frequency domain statistic anomaly detection. The method can simultaneously use or combine a plurality of anomaly detection technologies, thereby reducing the omission factor and the false alarm rate, effectively utilizing the telemetering time sequence data flow to quickly detect the anomaly of the satellite telemetering time sequence data in real time, helping experts to monitor the satellite running state in real time and ensuring the healthy and safe running of the satellite.
Description
Technical Field
The invention relates to the field of satellite detection and the technical field of computer data mining, in particular to a method for rapidly detecting the abnormality of satellite telemetry time sequence data in real time.
Background
Due to the operating environment of the satellite and the complexity of the satellite, various anomalies can occur during the in-orbit operation of the satellite under the influence of various factors. Timely detection and data anomaly detection are one of the keys for ensuring safe and healthy operation of the satellite.
The telemetering time sequence data flow of the satellite in the in-orbit operation process is the direct observed quantity of parameters of each component under each subsystem of the satellite, and can reflect the working state of each component. Finding data anomalies is an important step in performing satellite fault diagnostics. The abnormal change of the satellite telemetering time sequence data is found just like finding the affected part by means of X-ray, color ultrasound and the like when people see a doctor. The satellite continuously transmits various monitoring data to the ground when in orbit operation. Wherein the data for the most part of the time is normal data. Therefore, if all the data are manually interpreted to find out the abnormal change point, it takes a long time, and obviously the working efficiency is very low. Therefore, massive satellite time sequence data can be efficiently processed only by using a data mining method for a computer, and abnormal changes of the satellite can be timely and accurately mined. This is a primary process for satellite fault diagnosis, fault cause analysis, and satellite health management. Obviously, if the abnormal change point of the satellite cannot be found out quickly and accurately, the subsequent fault diagnosis activity cannot be carried out at all just like the doctor cannot find the affected part of the patient.
The following methods are generally used for detecting abnormalities: 1. model-based techniques first build a data model, and anomalies are objects that the same model cannot fit perfectly. For example, a model of the data distribution may be created by estimating parameters of the probability distribution. An object is considered to be an exception if it does not obey the distribution. 2. Proximity-based techniques define proximity metrics between objects, with anomalous objects being those that are far from most other objects. Distance-based outliers can be visually detected when the data can be presented in a two-dimensional or three-dimensional scatter plot. 3. Based on density techniques, an estimate of the density of an object can be computed relatively directly, particularly when there is a proximity metric between the objects. Objects in low density regions are relatively far from neighbors and may be considered as anomalies. These conventional anomaly detection methods require all data to be calculated for each detection, and thus it is difficult to process a large amount of data in real time.
In the existing processing technology for detecting the satellite telemetering time sequence data abnormity in real time, chinese patent CN201510319857.4 provides a method for diagnosing the temperature abnormity of an on-orbit satellite thruster in real time, chinese patent CN201910749737.6 provides a method for diagnosing and repairing the on-orbit autonomous fault of a multi-probe star nameplate sensor, and Chinese patent CN201610648303.3 provides a satellite abnormity detection method based on telemetering data wavelet transformation, and basic wavelets are adopted to carry out wavelet decomposition on telemetering data to obtain high-frequency components and low-frequency components. And carrying out window-based stationarity analysis on the signal reconstructed by the telemetering data high-frequency wavelet coefficient, and detecting the abnormality of the satellite by taking the mean square error of data in a window as an evaluation function of data stationarity. Chinese patent CN201811144187.7 provides a data-driven satellite subsystem anomaly prediction method, which sets the size of a sliding window as a first main period of a selection attribute by utilizing wavelet analysis and divides a satellite telemetering data stream by using the window. And a minimum rare mode is mined from the segmented window data by using bidirectional traversal, so that the mining efficiency is improved. And calculating an abnormality recognition factor of the minimum rare mode mined out, detecting the abnormality in the satellite telemetry data, and predicting the possible abnormal condition in the satellite subsystem.
The existing method can only carry out abnormity detection on specific on-orbit satellite parameter data and has great limitation. Or analyze the data from a single perspective and have insufficient reliability.
Disclosure of Invention
In order to overcome the defects of the prior art and solve the problem of real-time anomaly detection of the telemetry time sequence data of the orbiting satellite by using a computer, the invention aims to provide a method for quickly detecting the anomaly of the telemetry time sequence data of the satellite in real time, which is suitable for the real-time detection of the telemetry time sequence data of satellite component parameters.
In order to achieve the purpose, the invention adopts the technical scheme that:
a system for fast real-time detection of satellite telemetry timing data anomalies, comprising:
the data selection module is used for acquiring a real-time satellite telemetry time sequence data stream and preparing data for the next anomaly detection;
the model selection module is used for carrying out anomaly detection on any one or a combination of a time domain statistic anomaly detection model, a time domain first derivative anomaly detection model, a frequency domain similarity anomaly detection model and a frequency domain statistic anomaly detection model;
the model parameter setting module is used for completing the configuration of the size of the sliding window and the threshold;
the real-time anomaly detection module starts the selected anomaly detection module or the anomaly detection module combination after model parameter setting is finished, a telemetering time sequence data stream is loaded, the telemetering time sequence data stream is divided by using a sliding window, and anomaly scores are obtained by self-adaptively comparing a current window with the first k windows, wherein the time domain statistic anomaly detection model, the time domain first derivative anomaly detection model and the frequency domain statistic anomaly detection model take the percentage of the difference between each statistic of the current window and the total statistic corresponding to the first k windows in the total statistic of the first k windows as the anomaly scores, the frequency domain similarity anomaly detection model respectively calculates Euclidean distances by using the current window and the first k windows as similarity measurement, the maximum distance is selected as the anomaly score, if the anomaly score exceeds a threshold value, the telemetering data corresponding to the satellite component parameters is judged to be abnormal, the time of abnormal occurrence is positioned, and the detected anomaly is reported;
and the detection result display module is used for storing and analyzing the abnormal detection report result and graphically displaying the detection result.
The data selection module completes user setting including satellite types, data entities, data cleaning states, subsystems, components and parameters, and obtains real-time satellite telemetry time sequence data streams.
The time domain statistic anomaly detection model, the time domain first derivative anomaly detection model, the frequency domain similarity anomaly detection model and the frequency domain statistic anomaly detection model analyze data from two angles of a time domain and a frequency domain respectively, and the satellite telemetry time sequence data stream is processed in sections by utilizing a sliding window.
The time domain statistic anomaly detection model carries out anomaly point judgment and comprises the following steps:
(1) Extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance;
(2) Extracting the total statistics of the data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances;
(3) Calculating the percentage of the difference between each statistic of the current window and the statistic corresponding to the first k window totalities in the first k window totalities as an abnormal score;
(4) Comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is judged to be caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the step of judging the abnormal point by the time domain first derivative abnormality detection model comprises the following steps:
(1) Solving a first derivative value of the data in the current window;
(2) Extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance;
(3) Extracting the total statistics of data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances;
(4) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(5) Comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is judged to be caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the frequency domain statistic anomaly detection model comprises the following steps of:
(1) Performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data;
(2) Extracting statistics of data in a current window, including frequency corresponding to the maximum energy value, weighted average of the frequency and variance of the frequency;
(3) Extracting the overall statistics of data in the first K windows, and taking the frequency corresponding to the maximum value in the maximum values of energy in the K windows, the average value of weighted average of all frequencies and the average value of variance of all frequencies;
(4) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(5) Comparing the abnormal score with a given relative threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the frequency domain similarity anomaly detection model comprises the following steps of:
(1) Performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data;
(2) And respectively calculating Euclidean distances as similarity measurement between the current window and the first k windows, and selecting the maximum distance as an abnormal score.
(3) And comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold, judging that the current window data has abnormality, judging that the abnormality of the current window is caused by the last data because the step length of the sliding window is 1, namely the data is an abnormal point, and reporting the abnormality of the frequency domain similarity of the abnormal point.
The invention also provides a method for rapidly detecting the satellite telemetering time sequence data abnormity in real time, which comprises the following steps:
acquiring a real-time satellite telemetry time sequence data stream, and preparing data for the following anomaly detection;
configuring a sliding window size and a threshold;
the method adopts a mode of selecting one or a combination of a plurality of modes of time domain statistic abnormity detection, time domain first derivative abnormity detection, frequency domain similarity abnormity detection and frequency domain statistic abnormity detection, analyzes data from two angles of a time domain and a frequency domain respectively, and carries out abnormity detection, and the method comprises the following steps: loading a telemetering time sequence data stream, dividing the telemetering time sequence data stream by using a sliding window, and adaptively comparing a current window with the first k windows to obtain abnormal scores, wherein a time domain statistic abnormal detection model, a time domain first-order derivative abnormal detection model and a frequency domain statistic abnormal detection model take the percentage of the difference between each statistic of the current window and the total corresponding statistic of the first k windows in the total statistic of the first k windows as abnormal scores, a frequency domain similarity abnormal detection model respectively calculates Euclidean distances between the current window and the first k windows as similarity measurement, selects the largest distance as an abnormal score, carries out abnormal detection on telemetering time sequence data according to a threshold, if the abnormal score exceeds the threshold, judges that the telemetering data corresponding to satellite component parameters are abnormal, positions the time of abnormal occurrence, and reports the detected abnormal score;
and storing and analyzing the abnormal detection report result, and graphically displaying the detection result.
Specifically, the invention obtains a real-time satellite telemetering time sequence data stream by setting a satellite type, a data entity, a data cleaning state, a subsystem, a component and a parameter.
The abnormal satellite telemetering time sequence data obtained by the invention corresponds to the corresponding satellite abnormal change, so the satellite abnormal change can be judged according to the abnormal data. Specifically, the telemetering time sequence data flow of the satellite in the in-orbit operation process is the direct observed quantity of parameters of each component under each subsystem of the satellite, and can reflect the working state of each component. The remote measurement time sequence data flow of each component parameter is continuously transmitted to the ground when the satellite runs in orbit, the massive data is efficiently subjected to real-time abnormal detection processing by using a data mining method, and the abnormal change of the satellite can be timely and accurately mined. This is a primary process for satellite fault diagnosis, fault cause analysis, and satellite health management.
Compared with the prior art, the method and the device have the advantages that the telemetering data stream is processed in a segmented mode through the sliding window, the data of each window is compared with the data of the first k windows, the self-adaptability is realized, and the fixed upper and lower parameter limits do not need to be manually set. The invention analyzes data from multiple angles of time domain and frequency domain, integrates four real-time anomaly detection technologies, including time domain statistic anomaly detection, time domain first-order derivative anomaly detection, frequency domain similarity anomaly detection and frequency domain statistic anomaly detection, and can simultaneously use or combine a plurality of anomaly detection technologies, thereby reducing the omission factor and the false alarm rate, effectively utilizing the telemetering time sequence data stream to quickly detect the anomaly of the satellite telemetering time sequence data in real time, helping experts to monitor the running state of the satellite in real time, and ensuring the healthy and safe running of the satellite.
Drawings
FIG. 1 is a block diagram of the method of the present invention.
FIG. 2 is a general flow diagram of the method of the present invention.
FIG. 3 is a graph of the results of four real-time anomaly detection methods using specific parameter examples for the method of the present invention for "south shunt regulator temperature" and "+ Y energy-IN 5".
Detailed Description
The embodiments of the present invention will be described in detail below with reference to the drawings and examples.
As shown in fig. 1, the system for rapidly detecting the abnormality of the satellite telemetry time series data in real time of the present invention performs a segmentation process on the telemetry data stream by using a sliding window technology, and performs an abnormal point automatic detection by combining the inherent characteristics of the satellite telemetry time series data, and includes:
and the data selection module 1-1 is used for completing the setting of the satellite type, the data entity, the data cleaning state, the subsystem, the component and the parameter and preparing data for the next abnormity detection.
The satellite types are selected, namely the types of the selected satellites, and the selectable satellite types comprise high-orbit satellites and low-orbit satellites; the data entity selects a specific satellite entity under the corresponding satellite type; a data cleaning state, namely a state of selecting and detecting data cleaning, and optionally original data and normalized data; the subsystem is selected, namely a corresponding satellite entity subsystem is selected, and the selectable subsystem comprises a control propulsion subsystem and a power supply subsystem; the components are selected under the corresponding subsystem, the components which can be selected under the control propulsion subsystem comprise an engine, a thruster and the like, and the components which can be selected under the power subsystem comprise a north bus, a north storage battery pack and the like; the parameters are specific parameters under the selection of corresponding components, for example, the component selects a north battery pack, and the selectable parameters of the component include north battery pack charging current, north battery pack discharging capacity and the like.
The model selection module 1-2 completes the setting of an anomaly detection method, and performs anomaly detection on any one or a combination of a time domain statistic anomaly detection model, a time domain first derivative anomaly detection model, a frequency domain similarity anomaly detection model and a frequency domain statistic anomaly detection model; the anomaly detection modules analyze data from two different angles of a time domain and a frequency domain respectively, and are core parts for rapidly detecting the anomaly of satellite telemetry time sequence data in real time.
And the model parameter setting module 1-3 is used for completing the configuration of the size of the sliding window and the threshold value.
The real-time anomaly detection module 1-4 starts the selected anomaly detection module or the combination of the anomaly detection modules after the model parameter setting is completed, loads a telemetering time sequence data stream, divides the telemetering time sequence data stream by using a sliding window, carries out segmentation processing on the telemetering time sequence data stream, and compares a current window with the first k windows to obtain an anomaly score, wherein the time domain statistic anomaly detection module, the time domain first derivative anomaly detection module and the frequency domain statistic anomaly detection module take the percentage of the difference between each statistic of the current window and the total corresponding statistic of the first k windows to the total statistic of the first k windows as the anomaly score, and the frequency domain similarity anomaly detection module respectively calculates Euclidean distance between the current window and the first k windows as similarity measurement, selects the maximum distance as the anomaly score, has adaptivity, does not need to manually set fixed parameter upper and lower limits, specifically, the first k windows are taken as a 'benchmark', and compared with the data characteristics extracted from the current window, and the 'benchmark' is not fixed, but is updated in real-time according to the first k windows of the current window, so as the adaptivity. And then carrying out anomaly detection on the satellite telemetering time series data according to a threshold, if the anomaly score exceeds the threshold, judging that the telemetering data corresponding to the satellite component parameters is abnormal, positioning the time when the anomaly occurs, and reporting the detected anomaly.
And the detection result display module 1-5 is used for carrying out persistent storage and analysis on the abnormal detection report result and graphically displaying the detection result for the user through the returned result.
The system of the present invention also includes necessary components of a data analysis results graphical attempt component, a user interaction component, and the like.
According to fig. 1 and fig. 2, the real-time detection method of the present invention comprises the following processes:
step 1, data selection is carried out, a real-time satellite telemetry time sequence data stream is obtained, and data are prepared for the following abnormal detection;
2, selecting a model, and performing anomaly detection on one or more of a time domain statistic anomaly detection model, a time domain first derivative anomaly detection model, a frequency domain similarity anomaly detection model and a frequency domain statistic anomaly detection model;
step 3, model parameters are set according to the model selected in the previous step, namely the size of the sliding window and the configuration of a threshold are completed;
step 4, real-time anomaly detection, namely initializing model parameters according to the selection of the previous step, flowing into a satellite telemetering data stream, executing an anomaly detection method and carrying out automatic anomaly point identification; firstly, initializing model parameters including the size of a sliding window and a threshold value, and performing segmented processing on a telemetering time sequence data stream by utilizing a sliding window technology; comparing the current window with the previous k windows to obtain an abnormal score, if the abnormal score exceeds a threshold value, judging that the telemetering data corresponding to the satellite component parameters is abnormal, and positioning the time of the abnormal occurrence, specifically:
and for time domain statistic anomaly detection, extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance. Then, the maximum value of the maximum values, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances in the K window statistics are taken. Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score; and for the time domain first derivative abnormity detection, a first derivative value is calculated for the data in the current window. And extracting statistics of data in the current window, including maximum value, minimum value, mean value and variance. And then extracting the total statistics of the data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances. Calculating the percentage of the difference between each statistic of the current window and the statistic corresponding to the first k window totalities in the first k window totalities as an abnormal score; and for the frequency domain statistic abnormity detection, performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data. Then, the statistics of the data in the current window are extracted, including the frequency corresponding to the maximum energy value, the weighted average of the frequency and the variance of the frequency. Then, the overall statistics of the data in the first K windows are extracted, and the frequency corresponding to the maximum value of the energy maximum values in the K windows, the mean of the weighted average of all the frequencies and the mean of the variances of all the frequencies are taken. Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score; and for the frequency domain similarity abnormity detection, performing Fourier transform on the data in the current window, and further calculating to obtain an energy spectrum of the data. And respectively calculating Euclidean distances of the current window and the previous k windows to serve as similarity measurement, and selecting the maximum distance as an abnormal score. And after the abnormal score is obtained, performing abnormal judgment, comparing the abnormal score with a given threshold, if the abnormal score exceeds the threshold, judging that the current window data is abnormal, if the step length of the sliding window is 1, judging that the abnormality of the current window is caused by the last data, namely the data is an abnormal point, reporting the abnormal point, and visually displaying the result. If there is no anomaly, the sliding window is slid by a step size of 1, and then the next window is detected.
And 5, displaying the detection result, and visually displaying the detection result by analyzing the result returned by the anomaly detection method.
The following shows the specific flow of the method of the present invention with reference to specific data. Referring to fig. 1, firstly, data selection is carried out, two parameters of 'south shunt regulator temperature' and '+ Y energy source _ IN 5' are selected, and corresponding satellite telemetry time sequence data streams are obtained; secondly, selecting a model, and simultaneously selecting four real-time anomaly detection models, namely time domain statistic anomaly detection, time domain first derivative anomaly detection, frequency domain similarity anomaly detection and frequency domain statistic anomaly detection; and thirdly, setting model parameters, specifically comprising window size and threshold setting. The window size is defined as 10, each statistic threshold is set to 50, and the similarity threshold is set to 2; then initializing model parameters, flowing into a satellite telemetering data stream, and executing an abnormality detection method to automatically identify abnormal points; and finally, displaying the detection result, wherein the abnormal detection results of the two parameters refer to fig. 3. It can be seen from the figure that the method of the invention can effectively detect abnormal points in the satellite telemetering time sequence data, and corresponding abnormal changes of the satellite can be preliminarily judged through the abnormal points, thereby providing a basis for further detailed fault judgment.
In conclusion, the invention provides a method for rapidly detecting the abnormality of the satellite telemetering time sequence data in real time, which is suitable for the telemetering time sequence data of the satellite component parameters. The method of the invention carries out subsection processing on the telemetering data stream by utilizing the sliding window, each window data is compared with the first k windows, and the method has self-adaptability and does not need to manually set fixed upper and lower parameter limits. The method analyzes data from multiple angles of time domain and frequency domain, and integrates four real-time anomaly detection technologies, including time domain statistic anomaly detection, time domain first-order derivative anomaly detection, frequency domain similarity anomaly detection and frequency domain statistic anomaly detection. The method can simultaneously use or combine a plurality of anomaly detection technologies, thereby reducing the omission factor and the false alarm rate, effectively utilizing the telemetering time sequence data flow to quickly detect the anomaly of the satellite telemetering time sequence data in real time, helping experts to monitor the running state of the satellite in real time and ensuring the healthy and safe running of the satellite.
Claims (6)
1. A system for rapidly detecting anomalies in satellite telemetry timing data in real time, comprising:
the data selection module is used for acquiring a real-time satellite telemetry time sequence data stream and preparing data for the next abnormal detection;
the model selection module is used for carrying out anomaly detection by combining the time domain statistic anomaly detection model, the time domain first derivative anomaly detection model, the frequency domain similarity anomaly detection model and the frequency domain statistic anomaly detection model;
the model parameter setting module is used for completing the configuration of the size of the sliding window and the threshold;
the real-time anomaly detection module starts the selected anomaly detection module or the anomaly detection module combination after model parameter setting is finished, a telemetering time sequence data stream is loaded, the telemetering time sequence data stream is divided by using a sliding window, and anomaly scores are obtained by self-adaptively comparing a current window with the first k windows, wherein the time domain statistic anomaly detection model, the time domain first derivative anomaly detection model and the frequency domain statistic anomaly detection model take the percentage of the difference between each statistic of the current window and the total statistic corresponding to the first k windows in the total statistic of the first k windows as the anomaly scores, the frequency domain similarity anomaly detection model respectively calculates Euclidean distances by using the current window and the first k windows as similarity measurement, the maximum distance is selected as the anomaly score, if the anomaly score exceeds a threshold value, the telemetering data corresponding to the satellite component parameters is judged to be abnormal, the time of abnormal occurrence is positioned, and the detected anomaly is reported;
the detection result display module is used for storing and analyzing the abnormal detection report result and graphically displaying the detection result;
the time domain statistic anomaly detection model judges the anomaly points according to the time domain statistic, wherein the step of judging the anomaly points by the time domain statistic anomaly detection model comprises the following steps:
(1) Extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance;
(2) Extracting the total statistics of the data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances;
(3) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(4) Comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is judged to be caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the method for judging the abnormal point of the time domain first derivative abnormality detection model comprises the following steps:
(1) Solving a first derivative value of the data in the current window;
(2) Extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance;
(3) Extracting the total statistics of the data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances;
(4) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(5) Comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is judged to be caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the frequency domain statistic anomaly detection model carries out anomaly point judgment and comprises the following steps:
(1) Performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data;
(2) Extracting statistics of data in a current window, including frequency corresponding to the maximum energy value, weighted average of the frequency and variance of the frequency;
(3) Extracting the overall statistics of the data in the first K windows, and taking the frequency corresponding to the maximum value in the energy maximum values in the K windows, the mean value of the weighted average of all the frequencies and the mean value of the variance of all the frequencies;
(4) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(5) Comparing the abnormal score with a given relative threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the frequency domain similarity anomaly detection model comprises the following steps of:
(1) Performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data;
(2) Respectively calculating Euclidean distances between the current window and the first k windows as similarity measurement, and selecting the maximum distance as an abnormal score;
(3) And comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold, judging that the current window data has abnormality, judging that the abnormality of the current window is caused by the last data because the step length of the sliding window is 1, namely the data is an abnormal point, and reporting the abnormality of the frequency domain similarity of the abnormal point.
2. The system of claim 1, wherein the data selection module performs user configuration including satellite type, data entity, data purge status, subsystem, component, and parameters to obtain real-time satellite telemetry timing data stream.
3. The system for rapidly detecting the abnormality of the satellite telemetry time series data in real time according to claim 1, wherein the time domain statistic abnormality detection model, the time domain first derivative abnormality detection model, the frequency domain similarity abnormality detection model and the frequency domain statistic abnormality detection model analyze data from two angles of a time domain and a frequency domain respectively, and the satellite telemetry time series data stream is processed in sections by using a sliding window.
4. A method for rapidly detecting satellite telemetry time series data abnormity in real time is characterized by comprising the following steps:
acquiring a real-time satellite telemetry time sequence data stream, and preparing data for the following anomaly detection;
configuring a sliding window size and a threshold;
the method comprises the following steps of analyzing data from two angles of a time domain and a frequency domain respectively by using a mode of combining time domain statistic anomaly detection, time domain first derivative anomaly detection, frequency domain similarity anomaly detection and frequency domain statistic anomaly detection to perform anomaly detection, wherein the method comprises the following steps: loading a telemetering time sequence data stream, dividing the telemetering time sequence data stream by using a sliding window, and adaptively comparing a current window with the first k windows to obtain abnormal scores, wherein a time domain statistic abnormal detection model, a time domain first-order derivative abnormal detection model and a frequency domain statistic abnormal detection model take the percentage of the difference between each statistic of the current window and the total corresponding statistic of the first k windows in the total statistic of the first k windows as abnormal scores, a frequency domain similarity abnormal detection model respectively calculates Euclidean distances between the current window and the first k windows as similarity measurement, selects the largest distance as an abnormal score, carries out abnormal detection on telemetering time sequence data according to a threshold, if the abnormal score exceeds the threshold, judges that the telemetering data corresponding to satellite component parameters are abnormal, positions the time of abnormal occurrence, and reports the detected abnormal score;
storing and analyzing the abnormal detection report result, and graphically displaying the detection result;
wherein the step of performing anomaly determination comprises:
(1) Extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance;
(2) Extracting the total statistics of data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances;
(3) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(4) Comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is judged to be caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the method for judging the abnormal point of the time domain first derivative abnormality detection model comprises the following steps:
(1) Solving a first derivative value of the data in the current window;
(2) Extracting statistics of data in a current window, including a maximum value, a minimum value, a mean value and a variance;
(3) Extracting the total statistics of the data in the first K windows, and taking the maximum value of the maximum values in the statistics of the K windows, the minimum value of all the minimum values, the mean value of all the mean values and the mean value of all the variances;
(4) Calculating the percentage of the difference between each statistic of the current window and the overall corresponding statistic of the first k windows in the overall statistic of the first k windows as an abnormal score;
(5) Comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is judged to be caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the frequency domain statistic anomaly detection model carries out anomaly point judgment and comprises the following steps:
(1) Performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data;
(2) Extracting statistics of data in a current window, including frequency corresponding to the maximum energy value, weighted average of the frequency and variance of the frequency;
(3) Extracting the overall statistics of data in the first K windows, and taking the frequency corresponding to the maximum value in the maximum values of energy in the K windows, the average value of weighted average of all frequencies and the average value of variance of all frequencies;
(4) Calculating the percentage of the difference between each statistic of the current window and the statistic corresponding to the first k window totalities in the first k window totalities as an abnormal score;
(5) Comparing the abnormal score with a given relative threshold, if the abnormal score is larger than the threshold of a certain statistic, judging that the current window data is abnormal, and reporting the abnormality of the statistic corresponding to the abnormal point if the abnormal score is caused by the last data, namely the data is the abnormal point, because the step length of the sliding window is 1;
the frequency domain similarity anomaly detection model comprises the following steps of:
(1) Performing Fourier transform on data in the current window, and further calculating to obtain an energy spectrum of the data;
(2) Respectively calculating Euclidean distances of a current window and the previous k windows to serve as similarity measurement, and selecting the maximum distance as an abnormal score;
(3) And comparing the abnormal score with a given threshold, if the abnormal score is larger than the threshold, judging that the current window data has abnormality, judging that the abnormality of the current window is caused by the last data because the step length of the sliding window is 1, namely the data is an abnormal point, and reporting the abnormality of the frequency domain similarity of the abnormal point.
5. The method of claim 4, wherein the real-time satellite telemetry time series data stream is obtained by setting satellite type, data entity, data purge status, subsystems, components and parameters.
6. The method of claim 4, wherein the abnormal satellite telemetry time series data corresponds to a corresponding abnormal change in the satellite.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010764018.4A CN111858680B (en) | 2020-08-01 | 2020-08-01 | System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010764018.4A CN111858680B (en) | 2020-08-01 | 2020-08-01 | System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111858680A CN111858680A (en) | 2020-10-30 |
| CN111858680B true CN111858680B (en) | 2022-10-25 |
Family
ID=72954257
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010764018.4A Active CN111858680B (en) | 2020-08-01 | 2020-08-01 | System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111858680B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112286951A (en) * | 2020-11-26 | 2021-01-29 | 杭州数梦工场科技有限公司 | Data detection method and device |
| CN112948755B (en) * | 2021-04-01 | 2023-06-23 | 中国空空导弹研究院 | Telemetry sine parameter interpretation method |
| CN113852440B (en) * | 2021-09-29 | 2023-12-29 | 应急管理部国家自然灾害防治研究院 | Method and system for precise time calibration of electromagnetic field observation data of Zhangheng first satellite |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102664006A (en) * | 2012-04-14 | 2012-09-12 | 中国人民解放军国防科学技术大学 | Abnormal voice detecting method based on time-domain and frequency-domain analysis |
| WO2015107268A1 (en) * | 2014-01-16 | 2015-07-23 | Aboa Legis Oy | Method and device for the detection of respiratory rate |
| CN106055919A (en) * | 2016-08-09 | 2016-10-26 | 航天东方红卫星有限公司 | Satellite abnormity detection method based on telemetry data wavelet transformation |
| CN106650297A (en) * | 2017-01-06 | 2017-05-10 | 南京航空航天大学 | Non-domain knowledge satellite sub-system exception detection method |
| CN108063698A (en) * | 2017-12-15 | 2018-05-22 | 东软集团股份有限公司 | Unit exception detection method and device, program product and storage medium |
| CN110187275A (en) * | 2019-06-06 | 2019-08-30 | 中车株洲电力机车研究所有限公司 | A kind of magneto method for detecting health status and system |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10317275B2 (en) * | 2016-01-20 | 2019-06-11 | Simmonds Precision Products, Inc. | Vibration monitoring systems |
-
2020
- 2020-08-01 CN CN202010764018.4A patent/CN111858680B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102664006A (en) * | 2012-04-14 | 2012-09-12 | 中国人民解放军国防科学技术大学 | Abnormal voice detecting method based on time-domain and frequency-domain analysis |
| WO2015107268A1 (en) * | 2014-01-16 | 2015-07-23 | Aboa Legis Oy | Method and device for the detection of respiratory rate |
| CN106055919A (en) * | 2016-08-09 | 2016-10-26 | 航天东方红卫星有限公司 | Satellite abnormity detection method based on telemetry data wavelet transformation |
| CN106650297A (en) * | 2017-01-06 | 2017-05-10 | 南京航空航天大学 | Non-domain knowledge satellite sub-system exception detection method |
| CN108063698A (en) * | 2017-12-15 | 2018-05-22 | 东软集团股份有限公司 | Unit exception detection method and device, program product and storage medium |
| CN110187275A (en) * | 2019-06-06 | 2019-08-30 | 中车株洲电力机车研究所有限公司 | A kind of magneto method for detecting health status and system |
Non-Patent Citations (2)
| Title |
|---|
| "Abnormal Data Classification Using Time-Frequency Temporal Logic";Luan Viet Nguyen et al.;《ACM：Proceedings of the 20th International Conference on Hybrid Systems: Computation and Control》;20170413;237-242页 * |
| "一种基于时序分析异常数据的跌倒行为监测方法";王忠民 等;《计算机应用研究》;20180331;839-843页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111858680A (en) | 2020-10-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111858680B (en) | System and method for rapidly detecting satellite telemetry time sequence data abnormity in real time | |
| CN110414155B (en) | Fan component temperature abnormity detection and alarm method with single measuring point | |
| EP3105644B1 (en) | Method of identifying anomalies | |
| US9933338B2 (en) | Health management system, fault diagnosis system, health management method, and fault diagnosis method | |
| Coble et al. | Applying the general path model to estimation of remaining useful life | |
| US8868985B2 (en) | Supervised fault learning using rule-generated samples for machine condition monitoring | |
| CN106528975B (en) | A kind of prognostic and health management method applied to Circuits and Systems | |
| EP3454289A1 (en) | Plant abnormality detection method and system | |
| CN107797537A (en) | A kind of prognostic and health management method applied to automatic production line | |
| CN102636740B (en) | Method for predicting faults of power electronic circuit based on FRM-RVM (fuzzy rough membership-relevant vector machine) | |
| CN110414154B (en) | Fan component temperature abnormity detection and alarm method with double measuring points | |
| CN112416643A (en) | Unsupervised anomaly detection method and unsupervised anomaly detection device | |
| AU2002246994A1 (en) | Diagnostic systems and methods for predictive condition monitoring | |
| WO2011073613A1 (en) | A method, apparatus and computer program for diagnosing a mode of operation of a machine | |
| CN111796233B (en) | Method for evaluating secondary errors of multiple voltage transformers in double-bus connection mode | |
| CN112416662A (en) | Multi-time series data anomaly detection method and device | |
| CN116629627A (en) | Intelligent detection system of power transmission on-line monitoring device | |
| CN110469461B (en) | Fracture estimation method and device for fan toothed belt and readable storage medium | |
| CN115372816A (en) | Power distribution switchgear operation fault prediction system and method based on data analysis | |
| CN116756909A (en) | Early warning diagnosis system of thermal power plant based on data model and mechanism model | |
| CN112664410B (en) | Big data-based modeling method for unit online monitoring system | |
| CN109523030A (en) | A kind of telemetry parameter exception monitoring system based on machine learning | |
| KR20220132824A (en) | Distribution facility condition monitoring system and method | |
| US11339763B2 (en) | Method for windmill farm monitoring | |
| Wang et al. | RUSHAP: A Unified approach to interpret Deep Learning model for Remaining Useful Life Estimation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |