CN116628621A - Method, device, equipment and storage medium for diagnosing abnormal event of multi-element time sequence data - Google Patents
Method, device, equipment and storage medium for diagnosing abnormal event of multi-element time sequence data Download PDFInfo
- Publication number
- CN116628621A CN116628621A CN202310395073.4A CN202310395073A CN116628621A CN 116628621 A CN116628621 A CN 116628621A CN 202310395073 A CN202310395073 A CN 202310395073A CN 116628621 A CN116628621 A CN 116628621A
- Authority
- CN
- China
- Prior art keywords
- time
- moment
- abnormal
- code
- anomaly
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 117
- 238000000034 method Methods 0.000 title claims abstract description 76
- 238000003860 storage Methods 0.000 title claims description 11
- 238000001514 detection method Methods 0.000 claims abstract description 53
- 238000003745 diagnosis Methods 0.000 claims abstract description 48
- 238000007781 pre-processing Methods 0.000 claims abstract description 18
- 108091026890 Coding region Proteins 0.000 claims abstract description 11
- 230000005856 abnormality Effects 0.000 claims description 55
- 238000004364 calculation method Methods 0.000 claims description 20
- 239000011159 matrix material Substances 0.000 claims description 14
- 238000012545 processing Methods 0.000 claims description 14
- 238000010606 normalization Methods 0.000 claims description 11
- 238000004590 computer program Methods 0.000 claims description 7
- 230000004927 fusion Effects 0.000 claims description 3
- 238000010586 diagram Methods 0.000 description 14
- 238000012549 training Methods 0.000 description 13
- 230000008569 process Effects 0.000 description 6
- 230000007246 mechanism Effects 0.000 description 5
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 5
- 238000009826 distribution Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 4
- 238000011156 evaluation Methods 0.000 description 4
- 230000006870 function Effects 0.000 description 4
- 230000004044 response Effects 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 3
- 238000002474 experimental method Methods 0.000 description 3
- 239000000284 extract Substances 0.000 description 3
- 230000002123 temporal effect Effects 0.000 description 3
- 238000011282 treatment Methods 0.000 description 3
- 238000004821 distillation Methods 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 238000009776 industrial production Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000000513 principal component analysis Methods 0.000 description 2
- 230000000306 recurrent effect Effects 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000000052 comparative effect Effects 0.000 description 1
- 125000004122 cyclic group Chemical group 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 230000008447 perception Effects 0.000 description 1
- 238000005096 rolling process Methods 0.000 description 1
- 238000000638 solvent extraction Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 230000036962 time dependent Effects 0.000 description 1
- 238000000714 time series forecasting Methods 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/25—Fusion techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
- G06N3/0455—Auto-encoder networks; Encoder-decoder networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/0464—Convolutional networks [CNN, ConvNet]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/04—Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem"
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
- G06Q10/06393—Score-carding, benchmarking or key performance indicator [KPI] analysis
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S10/00—Systems supporting electrical power generation, transmission or distribution
- Y04S10/50—Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- General Engineering & Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Economics (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Health & Medical Sciences (AREA)
- Development Economics (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Computing Systems (AREA)
- Molecular Biology (AREA)
- General Health & Medical Sciences (AREA)
- Computational Linguistics (AREA)
- Biophysics (AREA)
- Biomedical Technology (AREA)
- Game Theory and Decision Science (AREA)
- General Business, Economics & Management (AREA)
- Tourism & Hospitality (AREA)
- Quality & Reliability (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Educational Administration (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The application provides a method for diagnosing abnormal events of multiple time sequence data, which comprises the following steps: preprocessing the original data in the multi-element time sequence to obtain a multi-element time sequence at each moment; according to the multi-element time sequence of each moment, fusing the obtained time code, numerical code and position code to obtain a characteristic code sequence; inputting the feature coding sequence into an Informir prediction model to obtain predicted values at all moments; obtaining an anomaly score according to a prediction error obtained by comparing the prediction value with a true value at a corresponding moment; comparing the anomaly score with a preset threshold value to obtain an anomaly detection result; and calculating a root score vector according to the abnormal event determined by the abnormal detection result, and diagnosing and obtaining an abnormal index causing the abnormal event based on the root score vector. According to the application, the time characteristics of the extracted time sequence data are embedded through the time codes, the detected continuous abnormal time points are determined to be abnormal events, and the detection efficiency and the diagnosis accuracy of the multi-element time sequence are improved.
Description
Technical Field
The present application relates to the field of abnormality diagnosis technologies, and in particular, to a method, an apparatus, a device, and a storage medium for diagnosing abnormal events of multiple time series data.
Background
The GTA (Graph Learning with Transformer for Anomaly detection) designs a directed graph structure learning strategy based on a transducer and a multi-element time sequence abnormality detection framework for graph learning, and considers a single time sequence as nodes in the graph, and hidden relations to be found among the nodes are regarded as edges in the graph, so that a graph structure describing the time sequence relations is learned. The learned graph structure is input into a graph convolution layer for information propagation modeling, and then the graph convolution layers are integrated with different levels of extended convolution layers to construct a hierarchical context coding block special for time data. The context code and the position code of the multi-element time sequence data are used as inputs of a transducer, the output of the transducer is a predicted single-step time sequence value, and the time sequence generating the abnormality is detected and diagnosed according to a second norm of the difference between the time sequence predicted value and the real value.
The GTA is added with a drawing learning module and an anomaly detection module on the basis of an Informar (Beyond Efficient Transformer for Long Sequence Time-Series Forecasting, transform-based multi-element long time sequence prediction framework) and can perform anomaly detection on multi-element time sequence data. However, the model is complex, the training cost is high, only abnormal time points in the multi-element time sequence can be detected, and abnormal events and specific indexes causing the abnormality of the multi-element time sequence cannot be detected.
Therefore, how to improve the detection efficiency and the diagnosis accuracy of the multiplex time series becomes a problem to be solved.
The above information disclosed in the background section is only for enhancement of understanding of the background of the application and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art.
Disclosure of Invention
The application provides a method, a device, equipment and a storage medium for diagnosing abnormal events of multi-element time sequence data, which are used for solving the problems existing in the prior art.
In a first aspect, the present application provides a method for diagnosing an abnormal event of a multi-component time series data, comprising the steps of:
s1, preprocessing original data in a multi-element time sequence to obtain a multi-element time sequence at each moment;
s2, according to the multi-element time sequence of each moment, obtaining time codes, numerical codes and position codes of each moment, and fusing the time codes, the numerical codes and the position codes to obtain a characteristic code sequence;
s3, inputting the feature coding sequence into an Informir prediction model, and obtaining predicted values at all moments through the Informir prediction model;
s4, comparing the predicted value with a true value at a corresponding moment to obtain a predicted error at each moment, and calculating to obtain an abnormal score of data at each moment according to the predicted error;
S5, comparing the anomaly score with a preset threshold value, and obtaining an anomaly detection result of the data at each moment according to a comparison result;
and S6, calculating a root score vector according to the abnormal event determined by the abnormal detection result, and diagnosing and obtaining an abnormal index causing the abnormal event based on the root score vector.
In some embodiments, the S2 comprises:
s21, extracting time features and space features in the multi-element time sequence at each moment to obtain a time code value and a position code value;
s22, obtaining a numerical code corresponding to each moment by convolving the multi-element time sequence of each moment;
s23, expanding the time code value and the position code value to obtain the time code and the position code with the same dimension as the numerical code;
and S24, adding the numerical code, the time code and the position code to obtain a characteristic code sequence.
In some embodiments, the specific calculation formula of the time coding value is:
wherein h is t For hour code value, m t Encoding values for minutes, s t For the second code value, timeStamp t The table is the time stamp data at time t, hour information, minute information, second information in the time stamp data, respectively;
The numerical coding formula is as follows:
V t ＝Conv(X t )
wherein V is t For coding numerical values, X t Is a multi-element time sequence at the moment of convolution t;
the calculation formula of the position coding value is as follows:
wherein p is t For position-coded values pos t Encoding V for numerical values t Absolute position throughout the time series window.
In some embodiments, the S6 includes:
s61, determining an abnormal event based on the abnormal detection result;
s62, obtaining a corresponding abnormal score matrix according to the abnormal event;
s63, in the time dimension, carrying out summation processing on the abnormal score matrix to obtain a root score vector, wherein the root score vector comprises root scores corresponding to all indexes;
s64, sorting according to the root cause score to obtain a sorting result;
s65, diagnosing the index corresponding to the selected root cause score as an abnormal index based on the sorting result.
In some embodiments, the preprocessing includes normalization processing and sliding window partitioning processing.
In some embodiments, the S4 includes:
s41, obtaining prediction errors of all the moments according to the difference value of the true value and the predicted value of all the moments;
s42, carrying out mean variance normalization processing on the prediction errors at each moment to obtain an anomaly score matrix based on each index at each moment;
S43, obtaining the abnormal score of each index at a single time point according to the abnormal score matrix;
s44, taking the maximum anomaly score as the anomaly score of the time point in the anomaly scores of the indexes at the single time point.
In some embodiments, the calculation formula of the prediction error is:
wherein Err i (t) is the prediction error of index i at time t, x t As a true value of the instant t,a predicted value of the time t;
the calculation formula of the anomaly score is as follows:
wherein s is i (t) is an anomaly score, μ i For Err i Mean, sigma of i For Err i Is a variance of (c).
In a second aspect, the present application provides a multivariate time series data anomaly event diagnosis device, the device comprising:
the preprocessing module is used for preprocessing the original data in the multi-element time sequence to obtain the multi-element time sequence at each moment;
the fusion module is used for extracting the time characteristics of the multi-element time sequence at each moment, obtaining the time code, the numerical code and the position code at each moment according to the time characteristics, and fusing the time code, the numerical code and the position code to obtain a characteristic code sequence;
the time sequence prediction module is used for inputting the characteristic coding sequence into an Informir prediction model, and obtaining predicted values of all moments through the Informir prediction model;
The anomaly score calculation module is used for comparing the predicted value with the true value of the corresponding moment to obtain the predicted error of each moment, and calculating the anomaly score of the data of each moment according to the predicted error;
the abnormality detection module is used for comparing the abnormality score with a preset threshold value and obtaining an abnormality detection result of the data at each moment according to the comparison result;
and the anomaly diagnosis module is used for calculating a root score vector according to the anomaly event determined by the anomaly detection result and diagnosing an anomaly index causing the anomaly event based on the root score vector.
In a third aspect, the present application provides a terminal device, including:
a memory for storing a computer program;
and the processor is used for reading the computer program in the memory and executing the operation corresponding to the multivariate time sequence data abnormal event diagnosis method.
In a fourth aspect, the present application provides a computer-readable storage medium having stored therein computer-executable instructions for implementing the method for multiple time series data anomaly event diagnosis when executed by a processor.
The application provides a method, a device, equipment and a storage medium for diagnosing abnormal events of multi-element time sequence data, which comprise the following steps: s1, preprocessing original data in a multi-element time sequence to obtain a multi-element time sequence at each moment; s2, according to the multi-element time sequence of each moment, obtaining time codes, numerical codes and position codes of each moment, and fusing the time codes, the numerical codes and the position codes to obtain a characteristic code sequence; s3, inputting the feature coding sequence into an Informir prediction model, and obtaining predicted values at all moments through the Informir prediction model; s4, comparing the predicted value with a true value at a corresponding moment to obtain a predicted error at each moment, and calculating to obtain an abnormal score of data at each moment according to the predicted error; s5, comparing the anomaly score with a preset threshold value, and obtaining an anomaly detection result of the data at each moment according to a comparison result; and S6, calculating a root score vector according to the abnormal event determined by the abnormal detection result, and diagnosing and obtaining an abnormal index causing the abnormal event based on the root score vector. The method comprises the steps of preprocessing, code embedding, time sequence prediction, anomaly score calculation, anomaly detection and anomaly diagnosis on multi-element time sequence data, determining an anomaly event, carrying out normalization processing on original data by data preprocessing, and dividing the original data into multi-element time sequences by a sliding window method; the code embedding part extracts time characteristics of the preprocessed data, and fuses the extracted time characteristics with the original data to obtain new data; inputting data into an Informir prediction model in a time sequence prediction part, and outputting the data as a predicted value at a corresponding moment; the anomaly score calculating part compares the predicted value with the true value to obtain a predicted error, and then calculates the anomaly score of the data of each time point; the threshold selection part compares a preset threshold with the anomaly score to obtain an anomaly detection result of the data at each moment; the time characteristics of the time sequence data are embedded and extracted through time coding, so that the accuracy of abnormality diagnosis is improved on the premise of ensuring the accuracy and efficiency of abnormality detection; and determining the detected continuous abnormal time points as abnormal events, so that the detection efficiency and the diagnosis accuracy of the multi-element time sequence are improved.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description, serve to explain the principles of the application.
FIG. 1 is a schematic diagram of a method for diagnosing abnormal events of multiple time series data according to the present application;
FIG. 2 is a schematic diagram of an abnormal time point and an abnormal event in the method for diagnosing a multi-component time series data abnormal event according to the present application;
FIG. 3 is a schematic diagram of a sliding window involved in a method for diagnosing a multiple time series abnormal event according to the present application;
FIG. 4 is a schematic diagram of code embedding involved in the method for diagnosing a multiple time series abnormal event according to the present application;
FIG. 5 is a schematic diagram of an Informier prediction model involved in the method for diagnosing a multiple time series abnormal event provided by the application;
FIG. 6 is a schematic diagram of anomaly score computation involved in a method for diagnosing a multiple-time-series anomaly event according to the present application;
fig. 7 is a schematic diagram of abnormality diagnosis related to the method for diagnosing abnormal events with multiple time series data according to the present application.
Specific embodiments of the present application have been shown by way of the above drawings and will be described in more detail below. The drawings and the written description are not intended to limit the scope of the inventive concepts in any way, but rather to illustrate the inventive concepts to those skilled in the art by reference to the specific embodiments.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the technical solutions of the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are some embodiments of the present application, but not all embodiments of the present application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
The terminology used in the embodiments of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this embodiment of the application, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
Furthermore, the terms "first," "second," and the like, are used for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include one or more such feature. In the description of the present application, the meaning of "a plurality" or "a number" means two or more, unless specifically defined otherwise.
It should be understood that the structures, proportions, sizes, etc. shown in the drawings are for the purpose of understanding and reading the disclosure, and are not intended to limit the scope of the application, which is defined by the claims, but rather by the claims, unless otherwise indicated, and that any structural modifications, proportional changes, or dimensional adjustments, which would otherwise be apparent to those skilled in the art, would be made without departing from the spirit and scope of the application.
It should be understood that the term "and/or" as used herein is merely one relationship describing the association of the associated objects, meaning that there may be three relationships, e.g., a and/or B, may represent: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front-rear association object is an "or" relationship.
The words "if", as used herein, may be interpreted as "at … …" or "at … …" or "in response to a determination" or "in response to a detection", depending on the context. Similarly, the phrase "if determined" or "if detected (stated condition or event)" may be interpreted as "when determined" or "in response to determination" or "when detected (stated condition or event)" or "in response to detection (stated condition or event), depending on the context.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a product or system that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such product or system. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a commodity or system comprising such elements.
Detailed analysis of background art problems:
most of the current work on anomaly detection is only the point in time when anomalies are detected. In the actual industrial production process, the occurrence of the abnormality is not just a point of time, but may be continued for a while. The present application refers to a continuous period of abnormal time as an abnormal event, which is often caused by the same fault, caused by a sensor or sensors. Fig. 2 is a schematic diagram of an abnormal time point and an abnormal event in the method for diagnosing a multi-component time series data abnormal event according to the present application, as shown in fig. 2. Therefore, the abnormality diagnosis not only detects an abnormal event but also diagnoses a specific sensor or an index generated by the sensor that causes the abnormality. The sensor and index expressions are equivalent in the abnormality diagnosis of the present application.
The GTA regards each time sequence in the time window as nodes in the graph, and hidden relations to be found among the nodes are regarded as edges in the graph, so that a graph structure describing the time sequence relations is learned. Information propagation modeling is performed by utilizing graph convolution based on the learned graph structure, and then the graph convolution layers are integrated with different levels of extended convolution layers to construct a hierarchical context coding block special for time data. The context coding block makes the anomaly detection model too complex, resulting in long model training time and low anomaly detection efficiency. And the context coding block confuses the characteristics among different sensors, although the confused characteristics can detect abnormal time points, it is difficult to diagnose indexes causing abnormal events from the confused characteristics, which results in lower abnormality diagnosis accuracy of the GTA.
The detection and diagnosis of abnormal events in the multivariate time sequence are effective methods for guaranteeing the performance reliability, and are also the basis for further rapid damage stopping and root cause analysis of faults. The efficiency of anomaly detection and the accuracy of diagnosis have important significance for realizing intelligent perception and intelligent operation and maintenance of network situation. Therefore, improving the detection efficiency and the diagnostic accuracy of the multiplex time series is a problem that currently needs to be solved with emphasis.
Interpretation of technical terms:
the Informater aims to apply a transducer architecture to the field of multivariate time sequence prediction, improves the transducer architecture and provides an efficient transducer-based model Informater. Specifically, informar designed the ProbSparse self-saturation mechanism and distillation operation to address the challenges of secondary time complexity and secondary memory usage in conventional transformers. Furthermore, the elaborate generative decoder alleviates the limitations of the traditional encoder-decoder architecture. The effectiveness of the method in improving the prediction capability of the long-time sequence prediction problem is verified through experiments on real data.
The following describes the technical scheme of the present application and how the technical scheme of the present application solves the above technical problems in detail with specific embodiments. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. Embodiments of the present application will be described below with reference to the accompanying drawings.
Given raw data x= { X in the present application 1 ,x 2 ,…,x T }∈R T×m T is the time length and m is the dimension of the multivariate time series. X in the original data t ∈R m Data representing the time instant t is indicated, The value of the i-th index at time t is indicated. Detecting and diagnosing the multi-element time sequence abnormality of the original data to obtain a tag sequence Y= { Y 1 ,y 2 ,…,y T }∈R T×1 Tag y t =1 indicates that the time point t is abnormal.
Fig. 1 is a schematic diagram of a method for diagnosing a multi-component time series data abnormal event according to an embodiment of the present application, as shown in fig. 1, the method for diagnosing a multi-component time series data abnormal event according to the present application includes the following steps:
s1, preprocessing original data in a multi-element time sequence to obtain a multi-element time sequence at each moment;
it should be noted that the original data set may contain missing values during the acquisition process, and the missing values need to be filled before the data is input into the model, so as to avoid possible problems during training. In the present application, the missing data portion in the data set is filled with the non-missing value preceding the data.
The data in each dimension in the dataset is data collected on different sensors, and the values of the data tend to have different dimensions. In order to avoid that the data of different dimensions influence the effect of model training, data normalization processing is needed.
Specifically, in the embodiment of the present application, maximum and minimum normalization is used for the original data X, where the formula is:
After the data normalization processing, the speed of gradient descent to obtain the optimal solution can be increased, and the accuracy of anomaly detection and diagnosis can be improved.
FIG. 3 is a schematic diagram of a sliding window involved in the method for diagnosing abnormal events of multiple time series data, wherein the sliding window method is used for slicing normalized data as shown in FIG. 3; by adopting a sliding window with a window size w and a step length of 1, T-w+1 time sequences can be obtained. the time series at time t is expressed as:
X t ＝{x t-w ,x t-w+1 ,…,x t-1 }∈R w×m
wherein X is t And w is the window size, and m is an index.
S2, according to the multi-element time sequence of each moment, obtaining time codes, numerical codes and position codes of each moment, and fusing the time codes, the numerical codes and the position codes to obtain a characteristic code sequence;
in some embodiments, the S2 comprises:
s21, extracting time features and space features in the multi-element time sequence at each moment to obtain a time code value and a position code value;
s22, obtaining a numerical code corresponding to each moment by convolving the multi-element time sequence of each moment;
s23, expanding the time code value and the position code value to obtain the time code and the position code with the same dimension as the numerical code;
And S24, adding the numerical code, the time code and the position code to obtain a characteristic code sequence.
In order to capture the time correlation of the data, the application uses a time embedding method to extract the characteristic information such as seconds, minutes, hours and the like in the time stamp column of the preprocessed data to obtain the time code.
Fig. 4 is a schematic diagram of code embedding involved in the method for diagnosing a multiple time series abnormal event according to the present application, as shown in fig. 4, in some embodiments, the time code includes an hour code, a minute code and a second code, and a specific calculation formula of the time code value is:
wherein h is t For hour code value, m t Encoding values for minutes, s t For the second code value, timeStamp t The table is the time stamp data at time t, hour information, minute information, second information in the time stamp data, respectively;
the numerical coding calculation formula is as follows:
V t ＝Conv(X t )
wherein V is t For coding numerical values, X t Is a multi-element time sequence at the moment of convolution t;
it should be noted that, in the embodiment of the present application, the numerical code V t Is of dimension R w×d D is the dimension of the output characteristic obtained by the convolution operation.
The calculation formula of the position coding value is as follows:
Wherein p is t For position-coded values pos t Encoding V for numerical values t Absolute position throughout the time series window.
It should be noted that the numerical code V t By convolving a multiple time series X at time t t Obtained, position-coding P t Encoding the spatial features extracted from the data sequence.
It should be further noted that the position coding is based on pos t Sine or cosine transformation is adopted for even positions or odd positions in the time sequence window; the values of the hour code, minute code, and second code in the time code are obtained by extracting the time stamp TimeStamp at each time point t Hour information in (a)Minute information->Second information->And maps it to [ -0.5,0.5]Between them.
Copying and expanding all code values in the window w into d dimension to obtain the position code P t And time coding H t 、M t 、S t And P is t 、H t 、M t 、S t ∈R w×d . Adding the numerical code, the position code and the time code to obtain an input Z of a subsequent Infomer prediction model t I.e. a signature coding sequence.
In some embodiments, the calculation formula of the feature coding sequence is:
Z t ＝V t +P t +H t +M t +S t
wherein Z is t For characterizing the coding sequence, V t For coding numerical values, P t For position coding, H t For hour code, M t For minute code, S t Coded for seconds.
S3, inputting the feature coding sequence into an Informir prediction model, and obtaining predicted values at all moments through the Informir prediction model;
specifically, in the embodiment of the present application, the input time sequence Zt is predicted and analyzed based on the Informier prediction model, so as to obtain a predicted value at the time tInformater is a transform-based improved timing prediction model with three unique features:
(1) The probspark self-attention mechanism, which implements O (LlogL) in terms of time complexity and memory usage, and has comparable performance in sequence-dependent alignment;
(2) Self-attention distillation highlights dominant attention by halving the cascade layer input and efficiently handles very long input sequences;
(3) The generating decoder predicts long sequences in one forward operation, rather than stepwise, which greatly increases the inference speed of long sequence prediction.
Fig. 5 is a schematic diagram of an infomer prediction model related to the method for diagnosing abnormal events of multiple time series data, and as shown in fig. 5, the encoded data embedded in the elapsed time is input as an encoder of the infomer model, and the predicted value at the time t is output through an encoding and decoding structure.
Wherein the encoder inputs Z en ＝Z t ＝{z t-w ,z t-w+1 ,…,z t-1 Decoder input Z de ＝{z t-w/2 ,z t-w/2+1 ,…,z t-1 ,0}。Z en Extracting hidden layer state via multi-head ProbSparse attention mechanism in encoder, hidden layer state and decoder input Z de Enters the decoder together, passes through a series of attention layers and full connection layers, and finally is outputPredicted value at time t
The loss function of the prediction model adopts a mean square error loss function MSE for describing the true value x at the time t t And predicted valueThe formula of the gap size is as follows:
s4, comparing the predicted value with a true value at a corresponding moment to obtain a predicted error at each moment, and calculating to obtain an abnormal score of data at each moment according to the predicted error;
fig. 6 is a schematic diagram of anomaly score calculation involved in the method for diagnosing a multivariate time series data anomaly event according to the present application, as shown in fig. 6, in some embodiments, the step S4 includes:
s41, obtaining prediction errors of all the moments according to the difference value of the true value and the predicted value of all the moments;
specifically, the true value x at the time t is compared t And predicted valueCalculating a prediction error of the index i at a time t, wherein a calculation formula of the prediction error is as follows:
wherein Err i (t) is the prediction error of index i at time t, x t As a true value of the instant t,a predicted value of the time t;
s42, carrying out mean variance normalization processing on the prediction errors at each moment to obtain an anomaly score matrix based on each index at each moment;
s43, obtaining the abnormal score of each index at a single time point according to the abnormal score matrix;
since different indexes may have very different characteristics, the scale of their prediction errors may also be very different, and in order to prevent the error generated by any one index from exceeding other indexes, the prediction error of each index is subjected to mean variance normalization to obtain an anomaly score.
Specifically, the calculation formula of the anomaly score is as follows:
wherein s is i (t) is an anomaly score, μ i For Err i Mean, sigma of i For Err i Is a variance of (c).
The anomaly scores of all indexes at all times form an anomaly score matrix S, wherein S (t) represents the anomaly score S (t) = [ S ] of all indexes at time t 1 (t),...,s m (t)] T 。
S44, taking the maximum anomaly score as the anomaly score of the time point in the anomaly scores of the indexes at the single time point.
Specifically, the anomaly score as (t) at this point in time is:
s5, comparing the anomaly score with a preset threshold value, and obtaining an anomaly detection result of the data at each moment according to a comparison result;
In order to determine whether an abnormality occurs or not, after obtaining the abnormality score as, a threshold thr needs to be determined to judge the occurrence of the abnormality, if the abnormality score as exceeds the preset threshold thr, the moment is marked as abnormal, otherwise, the moment is considered as normal, and in the application, a grid search method is used for selecting the threshold.
And S6, calculating a root score vector according to the abnormal event determined by the abnormal detection result, and diagnosing and obtaining an abnormal index causing the abnormal event based on the root score vector.
In some embodiments, the S6 includes:
s61, determining an abnormal event based on the abnormal detection result;
specifically, all the abnormal events form an abnormal event set e= { E 1 ,e 2 ,…,e n N is the number of abnormal events; FIG. 7 is a schematic diagram of abnormality diagnosis related to the method for diagnosing abnormal events with multiple time series data according to the present application, as shown in FIG. 7, a continuous abnormal time point is defined as an abnormal event, an abnormal event e j All have abnormal start time s j And end time d j 。
S62, obtaining a corresponding abnormal score matrix according to the abnormal event;
specifically, according to the starting and ending time of the abnormality, the abnormality score matrix corresponding to the abnormality event can be expressed as Wherein l j Is the length of time that the exception event persists.
S63, in the time dimension, carrying out summation processing on the abnormal score matrix to obtain a root score vector, wherein the root score vector comprises root scores corresponding to all indexes;
specifically, the root cause score vector is:
s64, sorting according to the root cause score to obtain a sorting result;
s65, diagnosing the index corresponding to the selected root cause score as an abnormal index based on the sorting result.
Specifically, the indexes are ranked from large to small according to the root scores, and a ranked root score vector Rank (R (e))= [ k ] is obtained 1 ,k 2 ,...,k m ]∈R m Where k represents an index. The top ranking in Rank (R (e)) is the diagnostic abnormality index.
More specifically, in the embodiment of the present application, the number of the diagnosed abnormality indexes is 1-time true root cause or 1.5-time true root cause, and the number of indexes is related to the indexes hitrate@100 and hitrate@150 of the abnormality diagnosis performance.
The method comprises the steps of preprocessing, code embedding, time sequence prediction, anomaly score calculation, anomaly detection and anomaly diagnosis on multi-element time sequence data, determining an anomaly event, carrying out normalization processing on original data by data preprocessing, and dividing the original data into multi-element time sequences by a sliding window method; the code embedding part extracts time characteristics of the preprocessed data, and fuses the extracted time characteristics with the original data to obtain new data; inputting data into an Informir prediction model in a time sequence prediction part, and outputting the data as a predicted value at a corresponding moment; the anomaly score calculating part compares the predicted value with the true value to obtain a predicted error, and then calculates the anomaly score of the data of each time point; the threshold selection part compares a preset threshold with the anomaly score to obtain an anomaly detection result of the data at each moment; the time characteristics of the time sequence data are embedded and extracted through time coding, so that the accuracy of abnormality diagnosis is improved on the premise of ensuring the accuracy and efficiency of abnormality detection; and determining the detected continuous abnormal time points as abnormal events, performing diagnosis analysis on the abnormal events, calculating root cause scores of indexes, and determining the abnormal indexes according to the root cause scores, thereby improving the detection efficiency and the diagnosis accuracy of the multi-element time sequence.
The application also provides a device for diagnosing abnormal events of the multi-element time sequence data, which comprises:
the preprocessing module is used for preprocessing the original data in the multi-element time sequence to obtain the multi-element time sequence at each moment;
the fusion module is used for extracting the time characteristics of the multi-element time sequence at each moment, obtaining the time code, the numerical code and the position code at each moment according to the time characteristics, and fusing the time code, the numerical code and the position code to obtain a characteristic code sequence;
the time sequence prediction module is used for inputting the characteristic coding sequence into an Informir prediction model, and obtaining predicted values of all moments through the Informir prediction model;
the anomaly score calculation module is used for comparing the predicted value with the true value of the corresponding moment to obtain the predicted error of each moment, and calculating the anomaly score of the data of each moment according to the predicted error;
the abnormality detection module is used for comparing the abnormality score with a preset threshold value and obtaining an abnormality detection result of the data at each moment according to the comparison result;
and the anomaly diagnosis module is used for calculating a root score vector according to the anomaly event determined by the anomaly detection result and diagnosing an anomaly index causing the anomaly event based on the root score vector.
The application also provides a terminal device, comprising:
a memory for storing a computer program;
and the processor is used for reading the computer program in the memory and executing the operation corresponding to the multivariate time sequence data abnormal event diagnosis method.
The present application also provides a computer-readable storage medium having stored therein computer-executable instructions for implementing the multivariate time series data exception event diagnosis method when executed by a processor.
The following are specific examples:
the method of the present application was evaluated on two time series data sets as follows:
SWaT safe water treatment data set from one water treatment bench coordinated by singapore utility committee, the collection process lasted 11 days, the system was run 24 hours a day, and network traffic and values obtained for all 51 sensors and actuators were recorded.
WADI: the water distribution data set is a distribution system consisting of a large number of water distribution lines, forming a more complete and realistic water treatment, storage and distribution network as an extended WADI of the SWAT bench. The dataset included a total of 16 days of continuous operation, 14 days being routine operation and 2 days being the challenge scenario. The entire test stand contains 127 sensors and drives. Table 1 is a summary of the dataset, specifically as follows:
Table 1 summary of the dataset
| Data set | Number of time sequences | Training set | Test set | Abnormality rate |
| SWaT | 51 | 49500 | 45000 | 11.97％ |
| WADI | 127 | 76297 | 17280 | 5.99％ |
In order to verify the rationality and advancement of the proposed method, a comparative experiment was performed between the abnormality detection method and TCN-AE, omniAnomaly, MSCRED, GTA, informer.
TCN AE: a temporal convolution automatic encoder (Temporal convolutional autoencoder) uses an extended convolution based automatic encoder to detect anomalies with errors between the input and the reconstructed output.
OmniAnomaly: complex time correlations between multivariate observations are captured using a gating loop unit (Gated Recurrent Unit, GRU) and the observations are mapped to random variables using VAEs.
MSCRED: a Multi-scale convolutional cyclic codec (Multi-Scale Convolutional Recurrent Encoder-Decoder) uses the correlation properties between the convolutional encoder's de-encoding variables while using convolutional long-short-time memory (ConvLSTM) to de-capture the time-dependent properties. Finally, decoder reconstruction features are used to detect and diagnose anomalies.
Informar: informar captures the temporal characteristics of the multivariate time series using a codec structure that incorporates an attention mechanism, predicting the value of the time point. On the basis of which an abnormality detection and diagnosis function is added, the method of which is consistent with the present application. The difference from the present application is its lack of time-embedded modules.
GTA: an abnormality detection section was added on the basis of the Informir predictive model, but there was no abnormality diagnosis function. The same abnormality diagnosis section as that of the present application is added thereto, and the abnormality detection section thereof is made to coincide with that of the present application. The distinction from the present application is that it uses a graph convolution module instead of a time embedding module for feature extraction.
The model super parameters used by the application are the same as Informir and GTA, the layer number of the encoder is set to 3, and the layer number of the decoder is set to 2. For the conventional multi-head attention mechanism, the number of heads is set to 8. The dimension of the fully connected network is set to 128, equal to the model dimension.
The application performs 3 trials for each experiment and calculates the average.
Abnormality detection the method of the present application was evaluated using precision (Prec), recall (Rec) and F1-score (F1), with the following formulas:
/>
wherein TP represents a truly detected abnormality, FP represents an erroneously detected abnormality, TN represents a correctly recognized normal sample, and FN represents an erroneously recognized normal sample.
Abnormality diagnosis the abnormality diagnosis performance of the model was evaluated using HitRate@100, hitRate@150, RC-top-3. Hitrate@100 and hitrate@150 are hit rates of the root causes diagnosed with the anomaly event anomaly on the true root causes. If the number of the true root causes of a certain abnormal event is r, the model diagnoses that the hit number of the root cause of the top r and the true root cause in the root cause list obtained by the abnormal event is h 100 The top 1.5 times r hit root factor is h 150 . Hitrate @ 100=h 100 /r,HitRate@150＝h 150 And/r. RC-top-3 represents the probability that the first three causes diagnosed by the abnormal event contain the true cause, and if the first three causes contain the true cause, the value is 1. All evaluation indexes are average values obtained under all abnormal events.
Table 2 different methods best F1 score performance comparisons on SWaT and WADI datasets
The best F1 scores obtained for the different methods on SWaT and WADI data sets are shown in table 2. From this table it can be seen that the transform-based model GTA, informier and the method of the application have great advantages over other model accuracies, with the F1 scores of the three methods not differing much. The model precision Prec index of the application is highest in all models, and the F1 fraction is improved by about 0.3% compared with the original Informier model.
In practical industrial production, the speed and accuracy of model training are equally important, and table 3 compares the difference in training time for a transducer-based model over two data sets.
TABLE 3 training time comparison of SWaT and WADI at different methods
As can be seen from Table 3, the process of the present application has a significant improvement in efficiency over GTAs. The total training time is only half of the GTA, and Epoch num represents the number of times all data enter the model in one training process, and the average training time of each Epoch is about 60% -80%. The reason for the great improvement in efficiency is that the present application uses a time embedding module to extract the time characteristics of the data. Compared with a graph rolling module in the GTA, the time embedding module has lower training overhead. The method of the application can obtain the detection performance similar to the GTA in less training time.
TABLE 4 comparison of diagnostic indices of abnormalities for SWAT and WADI under different methods
The present application compares the magnitude of the performance of the different methods for anomaly diagnosis on the SWaT and WADI data sets as shown in table 4. Wherein tp suffixes indicate that only the abnormal events detected by the abnormal detection are considered, all the abnormal events are considered.
GTA, informier and the method of the present application based on a transducer model on SWAT datasets all lead significantly in anomaly diagnostic indices compared to other methods. Of these three methods, the GTA performed the worst, and the method of the present application performed the best. The reason is that the graph convolution module added in the GTA model confuses the characteristics among various indexes, which is not beneficial to abnormality diagnosis. The time embedding module added in the model extracts effective time characteristics on the premise of not confusing the index characteristics, and enhances the performance of abnormality diagnosis.
The OmniAnomaly method on the WADI dataset is higher than the method of the application in the evaluation index with tp suffix, but this does not represent that the effect of abnormality diagnosis is better. The reason is that the number of the detected abnormal events is small, so that the denominator is small when the evaluation index is calculated. In practice, the method of the application has more abnormal events detected and better abnormal diagnosis effect. The reason why the abnormality diagnosis evaluation indexes under the MSCRED method are all close to 0 is that in order to process the high-dimensional data set WADI within acceptable overhead, the PCA (Principal Component Analysis ) method is applied to the data preprocessing section for reducing the dimension. This operation changes the dimension of the data set, and thus abnormality diagnosis cannot be normally performed. In addition, the indicators of other methods are not generally as good as the methods of the present application.
From the foregoing, it can be seen from the tables that the method of the present application is best in terms of the overall effect of abnormality detection efficiency and abnormality diagnosis performance.
It should be understood that, although the steps in the flowcharts in the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited in order and may be performed in other orders, unless explicitly stated herein. Moreover, at least some of the steps in the figures may include multiple sub-steps or stages that are not necessarily performed at the same time, but may be performed at different times, the order of their execution not necessarily occurring in sequence, but may be performed alternately or alternately with other steps or at least a portion of the other steps or stages.
Those skilled in the art will appreciate that implementing all or part of the above-described methods may be accomplished by way of a computer program, which may be stored on a non-transitory computer readable storage medium and which, when executed, may comprise the steps of the above-described embodiments of the methods. Any reference to memory, storage, database, or other medium used in embodiments provided herein may include non-volatile and/or volatile memory. The nonvolatile memory can include Read Only Memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), memory bus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), among others.
Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the application pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.
It is to be understood that the application is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the application is limited only by the appended claims.
Claims (10)
1. The method for diagnosing the abnormal event of the multi-element time sequence data is characterized by comprising the following steps of:
s1, preprocessing original data in a multi-element time sequence to obtain a multi-element time sequence at each moment;
s2, according to the multi-element time sequence of each moment, obtaining time codes, numerical codes and position codes of each moment, and fusing the time codes, the numerical codes and the position codes to obtain a characteristic code sequence;
S3, inputting the feature coding sequence into an Informir prediction model, and obtaining predicted values at all moments through the Informir prediction model;
s4, comparing the predicted value with a true value at a corresponding moment to obtain a predicted error at each moment, and calculating to obtain an abnormal score of data at each moment according to the predicted error;
s5, comparing the anomaly score with a preset threshold value, and obtaining an anomaly detection result of the data at each moment according to a comparison result;
and S6, calculating a root score vector according to the abnormal event determined by the abnormal detection result, and diagnosing and obtaining an abnormal index causing the abnormal event based on the root score vector.
2. The abnormal event diagnosis method according to claim 1, wherein S2 comprises:
s21, extracting time features and space features in the multi-element time sequence at each moment to obtain a time code value and a position code value;
s22, obtaining a numerical code corresponding to each moment by convolving the multi-element time sequence of each moment;
s23, expanding the time code value and the position code value to obtain the time code and the position code with the same dimension as the numerical code;
And S24, adding the numerical code, the time code and the position code to obtain a characteristic code sequence.
3. The abnormal event diagnosis method according to claim 2, wherein the specific calculation formula of the time code value is:
wherein h is t For hour code value, m t Encoding values for minutes, s t For the second code value, timeStamp t The table is the time stamp data at time t, hour information, minute information, second information in the time stamp data, respectively;
the numerical coding formula is as follows:
V t ＝Conv(X t )
wherein V is t For coding numerical values, X t Is a multi-element time sequence at the moment of convolution t;
the calculation formula of the position coding value is as follows:
wherein p is t For position coding, pos t Encoding V for numerical values t Absolute position throughout the time series window.
4. The abnormal event diagnosis method according to claim 1, wherein S6 comprises:
s61, determining an abnormal event based on the abnormal detection result;
s62, obtaining a corresponding abnormal score matrix according to the abnormal event;
s63, in the time dimension, carrying out summation processing on the abnormal score matrix to obtain a root score vector, wherein the root score vector comprises root scores corresponding to all indexes;
S64, sorting according to the root cause score to obtain a sorting result;
s65, diagnosing the index corresponding to the selected root cause score as an abnormal index based on the sorting result.
5. The abnormal event diagnosis method according to claim 1, wherein the preprocessing includes normalization processing and sliding window division processing.
6. The abnormal event diagnosis method according to claim 1, wherein S4 comprises:
s41, obtaining prediction errors of all the moments according to the difference value of the true value and the predicted value of all the moments;
s42, carrying out mean variance normalization processing on the prediction errors at each moment to obtain an anomaly score matrix based on each index at each moment;
s43, obtaining the abnormal score of each index at a single time point according to the abnormal score matrix;
s44, taking the maximum anomaly score as the anomaly score of the time point in the anomaly scores of the indexes at the single time point.
7. The abnormal event diagnosis method according to claim 6, wherein the calculation formula of the prediction error is:
wherein Err i (t) is the prediction error of index i at time t, x t As a true value of the instant t,a predicted value of the time t;
the calculation formula of the anomaly score is as follows:
wherein s is i (t) is an anomaly score, μ i For Err i Mean, sigma of i For Err i Is a variance of (c).
8. A multiple time series data anomaly event diagnostic device, the device comprising:
the preprocessing module is used for preprocessing the original data in the multi-element time sequence to obtain the multi-element time sequence at each moment;
the fusion module is used for extracting the time characteristics of the multi-element time sequence at each moment, obtaining the time code, the numerical code and the position code at each moment according to the time characteristics, and fusing the time code, the numerical code and the position code to obtain a characteristic code sequence;
the time sequence prediction module is used for inputting the characteristic coding sequence into an Informir prediction model, and obtaining predicted values of all moments through the Informir prediction model;
the anomaly score calculation module is used for comparing the predicted value with the true value of the corresponding moment to obtain the predicted error of each moment, and calculating the anomaly score of the data of each moment according to the predicted error;
the abnormality detection module is used for comparing the abnormality score with a preset threshold value and obtaining an abnormality detection result of the data at each moment according to the comparison result;
And the anomaly diagnosis module is used for calculating a root score vector according to the anomaly event determined by the anomaly detection result and diagnosing an anomaly index causing the anomaly event based on the root score vector.
9. A terminal device, comprising:
a memory for storing a computer program;
a processor for reading the computer program in the memory and performing the operations corresponding to the multivariate time series data exception event diagnosis method according to any one of claims 1 to 7.
10. A computer readable storage medium having stored therein computer executable instructions which when executed by a processor are for implementing the method of multivariate time series data anomaly event diagnosis of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310395073.4A CN116628621A (en) | 2023-04-14 | 2023-04-14 | Method, device, equipment and storage medium for diagnosing abnormal event of multi-element time sequence data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310395073.4A CN116628621A (en) | 2023-04-14 | 2023-04-14 | Method, device, equipment and storage medium for diagnosing abnormal event of multi-element time sequence data |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116628621A true CN116628621A (en) | 2023-08-22 |
Family
ID=87637242
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310395073.4A Pending CN116628621A (en) | 2023-04-14 | 2023-04-14 | Method, device, equipment and storage medium for diagnosing abnormal event of multi-element time sequence data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116628621A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117190078A (en) * | 2023-11-03 | 2023-12-08 | 山东省计算中心（国家超级计算济南中心） | Abnormality detection method and system for monitoring data of hydrogen transportation pipe network |
| CN117688505A (en) * | 2024-02-04 | 2024-03-12 | 河海大学 | Prediction method and system for vegetation large-range regional negative abnormality |
-
2023
- 2023-04-14 CN CN202310395073.4A patent/CN116628621A/en active Pending
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117190078A (en) * | 2023-11-03 | 2023-12-08 | 山东省计算中心（国家超级计算济南中心） | Abnormality detection method and system for monitoring data of hydrogen transportation pipe network |
| CN117190078B (en) * | 2023-11-03 | 2024-02-09 | 山东省计算中心（国家超级计算济南中心） | Abnormality detection method and system for monitoring data of hydrogen transportation pipe network |
| CN117688505A (en) * | 2024-02-04 | 2024-03-12 | 河海大学 | Prediction method and system for vegetation large-range regional negative abnormality |
| CN117688505B (en) * | 2024-02-04 | 2024-04-19 | 河海大学 | Prediction method and system for vegetation large-range regional negative abnormality |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN116628621A (en) | Method, device, equipment and storage medium for diagnosing abnormal event of multi-element time sequence data | |
| CN112131673B (en) | Engine surge fault prediction system and method based on fusion neural network model | |
| Malhotra et al. | Multi-sensor prognostics using an unsupervised health index based on LSTM encoder-decoder | |
| Lv et al. | Fault diagnosis based on deep learning | |
| JP5431235B2 (en) | Equipment condition monitoring method and apparatus | |
| CN111914873A (en) | Two-stage cloud server unsupervised anomaly prediction method | |
| CN109581871B (en) | Industrial control system intrusion detection method of immune countermeasure sample | |
| CN113642754B (en) | Complex industrial process fault prediction method based on RF noise reduction self-coding information reconstruction and time convolution network | |
| JP2015172945A (en) | Facility state monitoring method and apparatus for the same | |
| JP2015148867A (en) | Information processing device, diagnosis method and program | |
| CN112861071B (en) | High-speed rail traction system anomaly detection method based on depth self-coding | |
| CN114417699A (en) | Pump valve fault detection method | |
| CN115758208A (en) | Traction converter fault diagnosis method and device, computer equipment and storage medium | |
| CN115983087A (en) | Method for detecting time sequence data abnormity by combining attention mechanism and LSTM and terminal | |
| CN115587335A (en) | Training method of abnormal value detection model, abnormal value detection method and system | |
| CN117076171A (en) | Abnormality detection and positioning method and device for multi-element time sequence data | |
| CN116796275A (en) | Multi-mode time sequence anomaly detection method for industrial equipment | |
| Xu et al. | Global attention mechanism based deep learning for remaining useful life prediction of aero-engine | |
| CN117113139A (en) | Training method and device for fault detection model, computer equipment and storage medium | |
| Yang et al. | Nuclear power plant sensor signal reconstruction based on deep learning methods | |
| CN116148906A (en) | Multi-attention-based fishing boat track anomaly detection method and system | |
| Qu et al. | Remaining Useful Life Prediction of High-Speed Railroad Contact Network Based on Stacking Integrated Attention-LSTM-CNN Deep Learning | |
| Lin et al. | An unsupervised noisy sample detection method for deep learning-based health status prediction | |
| Lee et al. | Event diagnosis method for a nuclear power plant using meta-learning | |
| Yi et al. | Anomaly Detection for Asynchronous Multivariate Time Series of Nuclear Power Plants Using a Temporal-Spatial Transformer |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |