CN117892214A - Construction method of abnormality detection model, abnormality detection method and abnormality detection system - Google Patents

Abstract

An abnormality detection model construction method, an abnormality detection method and an abnormality detection system relate to the field of machine learning, in particular to fault or abnormality detection of an industrial system. The method solves the problems that the traditional anomaly detection model has weak capability of extracting and analyzing nonlinear, strong time sequence and high-dimensional data, depends on initial data distribution when determining a threshold value, depends on personal experience, cannot be dynamically adjusted and the like. The anomaly detection model is constructed based on an LSTM-AE framework and an adaptive threshold value capable of automatically setting parameters; the abnormality detection method and the abnormality detection system adopt an abnormality detection model to detect the abnormality. The method is applied to abnormality detection of the industrial system.

Description

Construction method of abnormality detection model, abnormality detection method and abnormality detection system

Technical Field

The present invention relates to the field of machine learning technology, and in particular to fault or anomaly detection for industrial systems.

Background

The complexity and integration degree of modern industrial systems are increasing, and challenges of task and dynamic diversity of operation environments are faced, so that reliability and safety problems are also increasing. Meanwhile, with the development of low-cost sensing and communication technologies, modern industrial systems are generally provided with various fault and abnormality monitoring and detecting systems, and parameters such as states, performances, running environments and loads of the systems are monitored and recorded on line.

Existing fault and abnormality monitoring and detecting systems can be generally divided into the following two types:

1. the data of the normal running state and the abnormal running state of the system are collected by the sensor, mathematical models of the normal running state and the abnormal running state are respectively built through the analysis modeling tool, and classification boundaries of the data of the normal running state and the abnormal running state are searched for to finish the detection of the abnormality. Commonly used analytical modeling tools such as SVM (support vector machine), RF (random forest algorithm), deep learning, etc.;

2. the sensor is used for collecting data in a normal running state of the system, a mathematical model of the normal running state is established through an analysis modeling tool, and the detection of the abnormality is completed by searching the boundary of the data in the normal running state or capturing the characteristic that the normal running state has distinction relative to the abnormal running state. Commonly used analytical modeling tools, such as PCA (principal component analysis technique), one-Class SVM (support vector machine of single Class), deep learning, etc.

Compared with the common system which needs to detect the abnormality, the industrial system has the following characteristics: firstly, industrial systems generally have a huge and complex composition, and data acquired by sensors are often a large amount of nonlinear data; secondly, as sensor technology advances to make data collection easier, database size is larger and complexity is higher, and data dimension required to be analyzed and processed is higher and higher; further, the data collected in the industrial field has the characteristic of strong time sequence correlation, wherein the time sequence correlation refers to the degree of correlation between occurrence of data and time change, and the higher the degree of correlation is, the stronger the time sequence correlation is.

When the existing fault and abnormality monitoring and detecting system is applied to the industrial system with the characteristics, the following problems occur:

1. the characteristic extraction capability of the abnormality detection model in the prior art on nonlinear data is weak, so that the accuracy of abnormality detection on the nonlinear data in an industrial system is reduced;

2. the characteristic capturing capability of the abnormality detection model in the prior art on the data with strong time sequence is insufficient, so that the accuracy of abnormality detection on the data with strong time sequence in an industrial system is reduced;

3. the anomaly detection model in the prior art has weak analysis capability on high-dimensional data, so that the anomaly detection efficiency on an industrial system is reduced;

4. when an abnormality detection model in the prior art determines an abnormality detection threshold, the initial distribution of data is required to be used as a parameter to determine the threshold, but the initial distribution of the data cannot be clearly judged, and the common technical means is to approximately identify the initial distribution of the data as Gaussian distribution, so that the established model has a certain error, and the accuracy rate of abnormality detection on an industrial system is reduced;

5. when an abnormality detection model in the prior art determines an abnormality detection threshold, some parameters need to be set manually, the setting of the parameters depends on personal experience, different initial parameters can lead to different established data models, so that the obtained abnormality detection results are different, and further, the accuracy of abnormality detection on an industrial system depends on manual inspection and the consistency of the detection results of different people is poor;

6. The common method for determining the abnormality detection threshold by using the abnormality detection model in the prior art is to adopt a 3 sigma method or an extremum theory method, wherein the thresholds determined by the two methods are fixed thresholds, and the thresholds cannot be dynamically adjusted according to the change of environmental parameters, so that the environmental adaptability of abnormality detection on an industrial system is poor, and the abnormality detection accuracy of the industrial system under different working environments is low.

7. In the prior art, an abnormality detection method or an abnormality detection system adopts an abnormality detection model in the prior art, aiming at the detection of the operation abnormality of an industrial system, the accuracy of a detection result is low due to poor data extraction and analysis capability, the accuracy and consistency of the detection result are poor due to the fact that the parameter setting of an abnormality detection threshold depends on manual experience, and the adaptability of the detection method or the system to different working environments is poor due to the fact that the abnormality detection threshold cannot be adjusted in a self-adaptive mode.

Disclosure of Invention

The invention aims to provide a construction method, an anomaly detection method and an anomaly detection system of an anomaly detection model, so as to solve the technical problems in the prior art:

the technical problems of the invention are mainly solved by the following technical proposal:

The invention relates to a construction method of an abnormality detection model, which has the following technical scheme:

the construction method of the abnormality detection model comprises the following steps:

s1, under the stable operation condition of no abnormality of an industrial system to be detected, collecting data of a plurality of state parameters of the industrial system to be detected as original training time sequence data samples, wherein a set of the original training time sequence data samples is an original training time sequence data set of the industrial system in a no abnormality state;

s2, carrying out data preprocessing on the original training time sequence data samples to obtain training data samples, wherein a set of the training data samples is a training data set of the industrial system in a non-abnormal state;

s3, constructing a preliminary LSTM-AE model according to a self-encoder principle by utilizing long-time sequence modeling capability of the LSTM depth model;

s4, carrying out reconstruction training on the initial LSTM-AE model by utilizing the training data set, and optimizing a network weight value of the initial LSTM-AE model to obtain an error sequence of the trained LSTM-AE model and a training data sample;

s5, obtaining an adaptive threshold formula of the industrial system to be tested by utilizing the error sequence of the training data set, wherein the formula comprises a training data reconstruction error parameter, and a value of the adaptive threshold can be obtained by endowing the training data reconstruction error parameter with a value, and the value of the adaptive threshold is used for judging abnormal values to complete the construction of an abnormal detection model.

Further, a preferred embodiment is provided, wherein in the step S1:

the original training time sequence data sample is expressed as:

the original training time sequence data set is expressed as:

X＝{x ⁽¹⁾ ，x ⁽²⁾ ，....，x ⁽ⁱ⁾ ，....，x ⁽ⁿ⁾ }

wherein,

i∈[1，n]，j∈[1，m]

where n represents the original training time sequence data sample acquired at n time points, m represents that the original training time sequence data sample is composed of m dimension characteristics,data representing the j-th dimension of the original training time series data sample acquired at the i-th time point.

Further, a preferred embodiment is provided, wherein the step S2 is specifically as follows:

s2.1, performing standard vertebral processing on the data of each dimension in the acquired original training time sequence data sample, and expressing the data as follows by a formula:

the normalized raw training time series data samples are expressed as:

the normalized raw training time series data set is expressed as:

X ^* ＝{x ^(*1) ，x ^(*2) ，....，x ^(*i) ，...，x ^(*n) }

wherein,

j∈[1，m]

in the method, in the process of the invention,data representing the j-th dimension of the original training time series data sample acquired at the i-th time point after normalization, u (X) _j ) Represents the mean value of n original training time sequence data samples in the j dimension, sigma (X) _j ) Representing the variance of n original training time sequence data samples in the j dimension;

s2.2, carrying out equal time interval extraction on the standardized original training time sequence data sample to obtain a training data sample, wherein the specific process is as follows:

Let I be the extraction interval and L be the extraction length, then the first training data sample extracted is:

a ⁽¹⁾ ＝{x ^(*1) ，x ^(*2) ，...，x ^(*L) }

the kth training data sample extracted is represented as:

a ^(k) ＝{x ^{(*(1+(k-1)I))} ，x ^{(*(2+(k-1)I))} ，....，x ^{(*(L+(k-1)I))} }

let N be the total number of extracted training data samples, then the last item of data of the nth extracted training data sample:

wherein,

the set of N training data samples is a training data set, denoted as

A＝{a ⁽¹⁾ ，a ⁽²⁾ ，...，a ^(k) ，...，a ^(N) }。

Further, a preferred embodiment is provided, wherein the step S3 is specifically as follows:

the primary LSTM-AE model is divided into three layers, wherein two layers belong to an LSTM layer, and the other layer belongs to a linear full-connection layer;

the two LSTM layers are respectively an encoding layer and a decoding layer;

the dimension of the input parameters and the dimension of the output parameters of the coding layer, the decoding layer and the linear full-connection layer are set to be m, namely the dimension is the same as the dimension of the data sample input into the primary LSTM-AE model;

the coding layer is composed of L LSTM units, each LSTM unit of the coding layerRepresenting the coding hiding state at the time t;

the decoding layer is also composed of L LSTM units, each L of the decoding layerSTM cellRepresenting a decoding hidden state at the time t;

in the forward propagation of the neural network, the decoding hidden state of the decoding layer is set to be the same as the encoding hidden state of the encoding layer, i.e. at t=l When t is more than or equal to 1 and less than or equal to L-1, setting the decoding hidden state of the decoding layer as +.>Wherein F is _D Representing the operation of the decoding layer LSTM unit, < >>Decoding hidden state of decoding layer at time t+1, x ^t The method comprises the steps of inputting a preliminary LSTM-AE model corresponding to a middle t moment;

setting decoding hidden state of decoding layerThe input of the linear full-connection layer t moment is the output of the linear full-connection layer t moment is +.>The reconstruction output corresponding to the t moment of the preliminary LSTM-AE model is obtained, f represents an activation function, and w and b are network weight values of the preliminary LSTM-AE model.

Further, a preferred embodiment is provided, wherein the step S4 is specifically as follows:

s4.1, constructing a neural network loss function, wherein the specific process is as follows:

training data sample a in training data set A ^(k) As input to the preliminary LSTM-AE model, the corresponding reconstructed output sequence is:

wherein,for the reconstruction output at time t, which is associated with training data sample a ^(k) X in (2) ^{(*(t+(k-1)I))} Correspondingly, record x ^{(*(t+(k-1)I))} Is x ^t The constructed neural network loss function is:

s4.2, carrying out reconstruction training on the preliminary LSTM-AE model, and updating and optimizing a network weight value, wherein the specific process is as follows:

setting a predefined training frequency, sequentially inputting all training data samples in the training data set A into the initial LSTM-AE model in a circulating way, taking the minimized neural network loss function as a target, updating the optimized network weight value, and when the circulating frequency reaches the predefined training frequency, finishing training to obtain the trained LSTM-AE model.

S4.3, after training is finished, training data sample a in training data set A ^(k) As input to the trained LSTM-AE model, the corresponding reconstructed output sequence is:

wherein,for the reconstruction output of the trained LSTM-AE model at the time t, the reconstruction output is matched with the training data sample a ^(k) X in (2) ^{(*(t+(k-1)I))} Correspondingly, record x ^{(*(t+(k-1)I))} Is x ^t X is then ^t The corresponding reconstruction errors are:

training data sample a ^(k) The corresponding error sequence is:

e _tr ＝{e ₁ ，e ₂ ，...，e _t ，....，e _L }。

further, a preferred embodiment is provided, wherein the step S5 is specifically as follows:

s5.1, calculating a calculation formula of an error threshold, wherein the formula comprises a parameter anomaly probability value q to be set, and the specific process is as follows:

calculating the distribution of extreme values in the error sequence of the training data set, wherein the formula is as follows:

wherein,

γ∈R，1+γx＞0

wherein x is the data in the error sequence; gamma is an extremum coefficient that depends on the initial distribution of the error sequence data;

fitting the distribution of extrema in the error sequence using a method based on the second polar value theorem, if and only if σ is present, then for x εR and 1+γx > 0:

wherein F is _t (X) represents the cumulative distribution function of X, t is the initial threshold, and X-t is the fraction exceeding the threshold t; the extreme value distribution accords with generalized pareto distribution at the X-t part, and the extreme value is fitted to the X-t part by using the generalized pareto distribution based on the second extreme value theorem; wherein the estimation of extremum coefficients gamma and sigma is obtained by using a maximum likelihood method and expressed as And->Obtaining a calculation formula of an error threshold value:

wherein N is _t Representing the number of X-T, n is the number of data, q is the abnormal probability value, and the error threshold T can be obtained by setting the value of the abnormal probability value q _tr ；

S5.2, automatically acquiring an optimal abnormal probability value through a formula method, setting an abnormal probability value q in a calculation formula of an error threshold value as the optimal abnormal probability value, and calculating to obtain the error threshold value T _tr The specific process is as follows:

the determination of the abnormal probability value q is equivalent to an optimization process, and the optimization target and the calculation process are as follows:

wherein T is _tr Is an error threshold; e, e _tr Is an error sequence; Δμ (e) _tr ) And delta sigma ² (e _tr ) Representing the variation of the mean and variance of the error sequence after removing the outliers; i e _a The number of anomalies is represented by the number of anomalies, which can be interpreted as q-value determination targeting the removal of data exceeding a threshold, such that e _tr The value at which the mean and standard deviation decay is greatest;

when the first formula isWhen the value of the abnormal probability value q in the formula is the maximum value, the value of the abnormal probability value q is the optimal abnormal probability value;

in the calculation formula of the error threshold value, setting the abnormal probability value q to be equal to the optimal abnormal probability value to obtain the error threshold value T _tr ；

S5.3 adaptive thresholdThe formula is:

wherein epsilon is a coefficient; η is a hyper-parameter coefficient; t (T) _rc Reconstructing error parameters for training data, the error threshold T may be determined by assigning different values to the training data reconstruction error parameters _tr And carrying out real-time adjustment.

The invention relates to a detection method for abnormality adjustment based on LSTM-AE and a dynamic threshold, which has the following technical scheme:

s6, under the working condition of the industrial system to be tested, collecting real-time data of a plurality of state parameters of the industrial system to be tested as original test time sequence data samples, wherein a set of the original test time sequence data samples is an original test time sequence data set of the industrial system to be tested;

s7, carrying out data preprocessing on the collected original test time sequence data samples to obtain test data samples, wherein a set of the test data samples is a test data set under a to-be-tested state of the industrial system;

s8, taking the test data samples as input of an anomaly detection model, calculating a reconstruction error and an error sequence of each test data sample, and giving the reconstruction error value of the test data samples to the training data reconstruction error parameter to obtain a self-adaptive threshold value; the abnormality detection model is constructed and obtained by the construction method according to any one of the embodiments;

S9, comparing the size relation between the reconstruction error of the test data sample and the value of the self-adaptive threshold value, and judging whether the industrial system to be tested is abnormal or not.

Further, a preferred embodiment is provided, and in the step S6:

the original test time sequence data sample is expressed as:

the raw test time series data set is expressed as:

Y＝{y ⁽¹⁾ ，y ⁽²⁾ ，...，y ⁽ⁱ⁾ ，...，y ⁽ⁿ⁾ }

wherein,

i∈[1，n′]，j∈[1，m]

where n 'represents the original test time series data sample acquired at n' time points, m represents that the original test time series data sample is composed of m dimensional features,data representing the j-th dimension of the original test time series data sample acquired at the i-th time point.

Further, a preferred embodiment is provided, wherein the step S7 is specifically as follows:

s7.1, performing standard vertebral processing on the data of each dimension in the acquired original test time sequence data sample, wherein the standard vertebral processing is expressed as follows:

the normalized raw test time series data samples are expressed as:

the normalized raw training time series data set can be expressed as:

Y ^* ＝{y ^(*1) ，y ^(*2) ，....，y ^(*i) ，...，y ^(*n′) }

wherein,

j∈[1，m]

in the method, in the process of the invention,representing a normalized time-series data sample of an original test collected at an ith time pointData of the j-th dimension of the present, u (Y _j ) And the mean value of the n' original training time sequence data samples in the j dimension, sigma (Y) _j ) Representing the variance of n' original test time series data samples in the j-th dimension;

s7.2, carrying out time interval extraction on the standardized original test time sequence data sample to obtain a test data sample, wherein the specific process is as follows:

let I be the extraction interval and L be the extraction length, then the first test data sample extracted is:

b ⁽¹⁾ ＝{y ^(*1) ，y ^(*2) ，...，y ^(*L) }

the kth test data sample extracted is expressed as:

b ^(k) ＝{y ^{(*(1+(k-1)I))} ，y ^{(*(2+(k-1)I))} ，....，y ^{(*(L+(k-1)I))} }

let N 'be the total number of extracted test data samples, then the last item of data of the N' th extracted test data sample:

it is known that the number of the components,

wherein n' is the number of sample data in the multi-dimensional time sequence data after the labeling and the tapering;

the set of N' test data samples is a test data set, denoted as

B＝{b ⁽¹⁾ ，b ⁽²⁾ ，...，b ^(k) ，...，b ^(N′) }。

The invention relates to an abnormality detection system, which has the following technical scheme:

the system comprises: a processor and a memory, wherein the memory is configured to store executable instructions of the processor, and the processor is configured to perform an anomaly detection method according to any one of the above embodiments via execution of the executable instructions.

The invention has the following beneficial effects:

the method is applied to the field of abnormality detection of the industrial system, and can effectively detect abnormal data in the operation data of the industrial system.

1. Aiming at the problem that the abnormality detection model in the prior art has low accuracy in detecting the abnormality of an industrial system due to the fact that the characteristic extraction capability of the abnormality detection model on nonlinear or time sequence-dependent data is low, the abnormality detection model can effectively adapt to the characteristics of strong nonlinearity and time sequence of the industrial field data by utilizing the processing capability of LSTM-AE on nonlinear data and the memory capability of long-time sequence dependence, and improves the accuracy in detecting the abnormality of the industrial system.

2. Aiming at the problem that the abnormality detection model in the prior art has low efficiency rate of abnormality detection on an industrial system due to weak analysis capability on high-dimensional data, the abnormality detection model can rapidly and efficiently analyze and model the high-dimensional data by utilizing the analysis capability on the high-dimensional data of LSTM-AE, and improves the efficiency of abnormality detection on the industrial system.

3. Aiming at the problems that when an abnormality detection model in the prior art determines an abnormality detection threshold value, the approximate Gaussian distribution of initial distribution of data is used as a parameter, so that an established initial data model has errors, and the accuracy of abnormality detection on an industrial system is reduced.

4. Aiming at the problems that when an abnormality detection model in the prior art determines an abnormality detection threshold, some parameters are required to be manually set, so that the accuracy of abnormality detection on an industrial system depends on manual inspection and the consistency of detection results of different people is poor.

5. Aiming at the problems that in the prior art, when the threshold value is determined, a 3 sigma method or an extremum theory method is mostly adopted, and the threshold value cannot be dynamically adjusted according to the change of environmental parameters, so that the environmental adaptability of the industrial system to perform anomaly detection is poor, and the accuracy of the industrial system to perform anomaly detection in different working environments is low.

6. The anomaly detection method and the anomaly detection system based on LSTM-AE and dynamic threshold adjustment, provided by the invention, are adopted to detect the operation anomaly of an industrial system, so that the accuracy is improved, the dependence on manual experience is reduced, the accuracy and consistency of detection results are improved, and the adaptability to different working environments is improved.

The abnormality detection model, the abnormality detection method and the abnormality detection system are applied to abnormality detection of an industrial system.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a block diagram of a model of the preliminary LSTM-AE in a preferred embodiment of the present invention;

FIG. 2 is a flow chart of a method for constructing an anomaly detection model according to a preferred embodiment of the present invention;

FIG. 3 is a flow chart of an anomaly detection method based on LSTM-AE and dynamic threshold adjustment in a preferred embodiment of the present invention.

Detailed Description

In order to better understand the technical solutions of the present invention, the following description will further describe the present invention in detail with reference to specific embodiments, and it should be understood that the specific features in the embodiments and examples of the present application are detailed descriptions of the technical solutions of the present application, and not limit the technical solutions of the present application, and the technical features in the embodiments and examples of the present application may be combined with each other without conflict.

The first embodiment provides a method for constructing an abnormality detection model, which is specifically described below with reference to fig. 1 and 2:

s1, under the stable operation condition of no abnormality of an industrial system to be detected, collecting data of a plurality of state parameters of the industrial system to be detected as original training time sequence data samples, wherein a set of the original training time sequence data samples is an original training time sequence data set of the industrial system in a no abnormality state;

s2, carrying out data preprocessing on the original training time sequence data samples to obtain training data samples, wherein a set of the training data samples is a training data set of the industrial system in a non-abnormal state;

S3, constructing a preliminary LSTM-AE model according to a self-encoder principle by utilizing long-time sequence modeling capability of the LSTM depth model;

s4, carrying out reconstruction training on the initial LSTM-AE model by utilizing the training data set, and optimizing a network weight value of the initial LSTM-AE model to obtain an error sequence of the trained LSTM-AE model and a training data sample;

s5, obtaining an adaptive threshold formula of the industrial system to be tested by utilizing the error sequence of the training data set, wherein the formula comprises a training data reconstruction error parameter, and a value of the adaptive threshold can be obtained by endowing the training data reconstruction error parameter with a value, and the value of the adaptive threshold is used for judging abnormal values to complete the construction of an abnormal detection model.

In this embodiment, the anomaly detection model is constructed based on an LSTM-AE framework and an adaptive threshold formula. The LSTM-AE framework has nonlinear data extraction capability, long-time sequence dependent memory capability and high-dimensional data analysis capability, and is matched with the nonlinear, time sequence and high-dimensional data characteristics of the industrial field. The abnormality detection model constructed based on the LSTM-AE framework is adopted to detect the abnormality of the industrial system, so that the accuracy of the detection result can be improved. Meanwhile, the abnormality detection model also adopts the self-adaptive threshold which does not depend on initial distribution of data, can automatically set parameters and can be adjusted in real time, so that when the model is applied to abnormality detection, the model self error is reduced, the dependence of human experience is reduced, the adaptive environment change is equivalent to the reduction of environment error, and the accuracy, stability and consistency of abnormality detection are improved.

In the second embodiment, the present embodiment is described with reference to fig. 1 and 2, and the present embodiment is further defined by step S1 in the method for constructing an abnormality detection model according to the first embodiment, and in step S1:

the original training time sequence data sample is expressed as:

the original training time sequence data set is expressed as:

X＝{x ⁽¹⁾ ，x ⁽²⁾ ，....，x ⁽ⁱ⁾ ，....，x ⁽ⁿ⁾ }

wherein,

i∈[1，n]，j∈[1，m]

where n represents the original training time sequence data sample acquired at n time points, m represents that the original training time sequence data sample is composed of m dimension characteristics,data representing the j-th dimension of the original training time series data sample acquired at the i-th time point.

In this embodiment, for example, the monitoring sensor of the industrial system collects 1 ten thousand time points of original training time series data samples, each time point of the original training time series data samples includes 5 dimensions of parameters, and the 5 dimensions may be temperature, humidity, gas pressure, illumination intensity and harmful gas concentration respectively, so that the collected original training time series data sets include 1 ten thousand×5 data in total.

In the third embodiment, the present embodiment is described with reference to fig. 1 and 2, and the present embodiment is further limited to the step S2 in the method for constructing an abnormality detection model according to the second embodiment, and specific implementation contents are as follows:

The step S2 specifically includes the following steps:

s2.1, performing standard vertebral processing on the data of each dimension in the acquired original training time sequence data sample, and expressing the data as follows by a formula:

the normalized raw training time series data samples are expressed as:

the normalized raw training time series data set is expressed as:

X ^* ＝{x ^(*1) ，x ⁽ * ²⁾ ，...，x ^(*i) ，...，x ^(*n) }

wherein,

j∈[1，m]

in the method, in the process of the invention,data representing the j-th dimension of the original training time series data sample acquired at the i-th time point after normalization, u (X) _j ) Represents the mean value of n original training time sequence data samples in the j dimension, sigma (X) _j ) Representing the variance of n original training time sequence data samples in the j dimension;

s2.2, carrying out equal time interval extraction on the standardized original training time sequence data sample to obtain a training data sample, wherein the specific process is as follows:

let I be the extraction interval and L be the extraction length, then the first training data sample extracted is:

a( ¹ )＝{x ^(*1) ，x ^(*2) ，...，x ^(*L) }

the kth training data sample extracted is represented as:

a ^(k) ＝{x ^{(*(1+(k-1)I))} ，x ^{(*(2+(k-1)I))} ，...，x ^{(*(L+(k-1)I))} }

let N be the total number of extracted training data samples, then the last item of data of the nth extracted training data sample:

wherein,

the set of N training data samples is a training data set, denoted as

A＝{a ⁽¹⁾ ，a ⁽²⁾ ，...，a ^(k) ，...，a ^(N) }。

In this embodiment, the significance of the tapering process of the data is: in practical problems, the obtained sample data are all in multiple dimensions, namely, a sample is characterized by multiple features, the dimensions and the numerical values of the features are different, in the case of anomaly detection, if the original data values are directly used, the influence degree of the original data values on anomaly judgment is different, and different features can have the same scale through normalization processing.

In the fourth embodiment, the present embodiment is described with reference to fig. 1 and 2, and the present embodiment is further defined in step S3 in the method for constructing an abnormality detection model according to the third embodiment, and specific implementation contents are as follows:

the step S3 specifically includes the following steps:

the primary LSTM-AE model is divided into three layers, wherein two layers belong to an LSTM layer, and the other layer belongs to a linear full-connection layer;

the two LSTM layers are respectively an encoding layer and a decoding layer;

the dimension of the input parameters and the dimension of the output parameters of the coding layer, the decoding layer and the linear full-connection layer are set to be m, namely the dimension is the same as the dimension of the data sample input into the primary LSTM-AE model;

the coding layer is composed of L LSTM units, each LSTM unit of the coding layerRepresenting the coding hiding state at the time t;

the decoding layer is also composed of L LSTM units, each LSTM unit of the decoding layerRepresenting a decoding hidden state at the time t;

in the forward propagation of the neural network, the decoding hidden state of the decoding layer is set to be the same as the encoding hidden state of the encoding layer, i.e. at t=lWhen t is more than or equal to 1 and less than or equal to L-1, setting the decoding hidden state of the decoding layer as +.>Wherein F is _D Representing the operation of the decoding layer LSTM unit, < > >Decoding hidden state of decoding layer at time t+1, x ^t The method comprises the steps of inputting a preliminary LSTM-AE model corresponding to a middle t moment;

setting decoding hidden state of decoding layerThe input of the linear full-connection layer t moment is the output of the linear full-connection layer t moment is +.>The reconstruction output corresponding to the t moment of the preliminary LSTM-AE model is obtained, f represents an activation function, and w and b are network weight values of the preliminary LSTM-AE model.

In this embodiment, the preliminary LSTM-AE model combines the advantages of the LSTM model in processing long-time sequences and the AE model in unsupervised feature learning, has strong feature extraction capability on nonlinear data or time-series data, has strong analysis capability on high-dimensional data, and is suitable for analyzing and processing multi-dimensional time-series data acquired in an industrial system.

In the fifth embodiment, the present embodiment is further defined in step S4 in the method for constructing an abnormality detection model according to the fourth embodiment, and specific implementation details are as follows:

the step S4 specifically includes the following steps:

s4.1, constructing a neural network loss function, wherein the specific process is as follows:

training data sample a in training data set A ^(k) As input to the preliminary LSTM-AE model, the corresponding reconstructed output sequence is:

Wherein,for the reconstruction output at time t, which is associated with training data sample a ^(k) X in (2) ^{(*(t+(k-1)I))} Correspondingly, record x ^{(*(t+(k-1)I))} Is x ^t The constructed neural network loss function is: />

S4.2, carrying out reconstruction training on the preliminary LSTM-AE model, and updating and optimizing a network weight value, wherein the specific process is as follows:

setting a predefined training frequency, sequentially inputting all training data samples in the training data set A into the initial LSTM-AE model in a circulating way, taking the minimized neural network loss function as a target, updating the optimized network weight value, and when the circulating frequency reaches the predefined training frequency, finishing training to obtain the trained LSTM-AE model.

S4.3, after training is finished, training data sample a in training data set A ^(k) As input to the trained LSTM-AE model, the corresponding reconstructed output sequence is:

wherein,for the reconstruction output of the trained LSTM-AE model at the time t, the reconstruction output is matched with the training data sample a ^(k) X in (2) ^{(*(t+(k-1)I))} Correspondingly, record x ^{(*(t+(k-1)I))} Is x ^t X is then ^t The corresponding reconstruction errors are:

training data sample a ^(k) The corresponding error sequence is:

e _tr ＝{e ₁ ，e ₂ ，....，e _t ，....，e _L }。

in the sixth embodiment, the present embodiment is further defined in step S5 in the method for constructing an abnormality detection model according to the fifth embodiment, and specific implementation details are as follows:

The step S5 specifically includes the following steps:

s5.1, calculating a calculation formula of an error threshold, wherein the formula comprises a parameter anomaly probability value q to be set, and the specific process is as follows:

calculating the distribution of extreme values in the error sequence of the training data set, wherein the formula is as follows:

wherein,

γ∈R，1+γx＞0

wherein x is the data in the error sequence; gamma is an extremum coefficient that depends on the initial distribution of the error sequence data;

fitting the distribution of extrema in the error sequence using a method based on the second polar value theorem, if and only if σ is present, then for x εR and 1+γx > 0:

wherein F is _t (X) represents the cumulative distribution function of X, t is the initial threshold, and X-t is the fraction exceeding the threshold t; the extreme value distribution accords with generalized pareto distribution at the X-t part, and the extreme value is fitted to the X-t part by using the generalized pareto distribution based on the second extreme value theorem; wherein the estimation of extremum coefficients gamma and sigma is obtained by using a maximum likelihood method and expressed asAnd->Obtaining a calculation formula of an error threshold value:

/>

wherein N is _t Representing the number of X-T, n is the number of data, q is the abnormal probability value, and the error threshold T can be obtained by setting the value of the abnormal probability value q _tr ；

S5.2, automatically acquiring an optimal abnormal probability value through a formula method, setting an abnormal probability value q in a calculation formula of an error threshold value as the optimal abnormal probability value, and calculating to obtain the error threshold value T _tr The specific process is as follows:

the determination of the abnormal probability value q is equivalent to an optimization process, and the optimization target and the calculation process are as follows:

wherein T is _tr Is an error threshold; e, e _tr Is an error sequence; Δμ (e) _tr ) And delta sigma ² (e _tr ) Representing the variation of the mean and variance of the error sequence after removing the outliers; i e _a The number of anomalies is represented by the number of anomalies, which can be interpreted as q-value determination targeting the removal of data exceeding a threshold, such that e _tr The value at which the mean and standard deviation decay is greatest;

when the first formula isWhen the average value is maximum, the value of the abnormal probability value q in the formula is an optimal abnormal probability value;

in the calculation formula of the error threshold value, setting the abnormal probability value q to be equal to the optimal abnormal probability value to obtain the error threshold value T _tr ；

S5.3 adaptive thresholdThe formula is:

wherein epsilon is a coefficient; η is a hyper-parameter coefficient; t (T) _rc Reconstructing error parameters for training data, the error threshold T may be determined by assigning different values to the training data reconstruction error parameters _tr And carrying out real-time adjustment.

In the embodiment, a method for fitting the extreme value by using generalized pareto distribution based on a second polar value theorem is adopted, and when a threshold value formula is determined, the initial distribution of data is not relied on, so that the error of an anomaly detection model is reduced; the method for equating the determination of the fixed threshold value to an optimization process is provided by utilizing the embodiment, and parameters are not required to be manually set when the fixed threshold value is determined, so that the dependence of the construction of an anomaly detection model on human experience is reduced; by utilizing the formula of obtaining the self-adaptive threshold according to the fixed threshold, the value of the self-adaptive threshold can be automatically adjusted according to the acquired real-time data, namely different test data samples, in the industrial system to be subjected to anomaly detection, so that the limitation of the traditional fixed threshold on the accuracy of anomaly detection is avoided, and the accuracy of anomaly detection of the industrial system in different working environments can be improved.

The seventh embodiment provides an anomaly detection method based on LSTM-AE and dynamic threshold adjustment, and the specific implementation contents are as follows:

the abnormality detection method includes:

s6, under the working condition of the industrial system to be tested, collecting real-time data of a plurality of state parameters of the industrial system to be tested as original test time sequence data samples, wherein a set of the original test time sequence data samples is an original test time sequence data set of the industrial system to be tested;

s7, carrying out data preprocessing on the collected original test time sequence data samples to obtain test data samples, wherein a set of the test data samples is a test data set under a to-be-tested state of the industrial system;

s8, taking the test data samples as input of an anomaly detection model, calculating a reconstruction error and an error sequence of each test data sample, and giving the reconstruction error value of the test data samples to the training data reconstruction error parameter to obtain a self-adaptive threshold value; the abnormality detection model is constructed by adopting the construction method according to any one of the first to sixth embodiments;

s9, comparing the size relation between the reconstruction error of the test data sample and the value of the self-adaptive threshold value, and judging whether the industrial system to be tested is abnormal or not.

An eighth embodiment is described with reference to fig. 1 and 2, and the present embodiment is a further limitation of step S6 in the anomaly detection method based on LSTM-AE and dynamic threshold adjustment described in the seventh embodiment, and specifically implemented as follows:

in the step S6:

the original test time sequence data sample is expressed as:

the raw test time series data set is expressed as:

Y＝{y ⁽¹⁾ ，y ⁽²⁾ ，...，y ⁽ⁱ⁾ ，...，y ⁽ⁿ⁾ }

wherein,

i∈[1，n′]，j∈[1，m]

where n 'represents the original test time series data sample acquired at n' time points, m represents that the original test time series data sample is composed of m dimensional features,representing the origin of the ith time point acquisitionAnd testing the data of the j-th dimension of the time sequence data sample.

In this embodiment, for example, the monitoring sensor of the industrial system collects 2 ten thousand time points of original test time series data samples, each time point of the original test time series data samples includes 5 dimensions of parameters, and the 5 dimensions should be the same as the dimensions of the original training time series data samples, namely, the dimensions of temperature, humidity, gas pressure, illumination intensity and harmful gas concentration respectively, and the collected original test time series data set includes 2 ten thousand×5 data in total.

In the ninth embodiment, the present embodiment is described with reference to fig. 1 and 2, and the embodiment is a further limitation of step S7 in the anomaly detection method based on LSTM-AE and dynamic threshold adjustment described in the seventh embodiment, and specific implementation contents are as follows:

the step S7 specifically includes the following steps:

s7.1, performing standard vertebral processing on the data of each dimension in the acquired original test time sequence data sample, wherein the standard vertebral processing is expressed as follows:

the normalized raw test time series data samples are expressed as:

the normalized raw training time series data set can be expressed as:

Y ^* ＝{y ^(*1) ，y ^(*2) ，...，y ^(*i) ，...，y ^(*n′) }

wherein,

j∈[1，m]

in the method, in the process of the invention,representing the raw test timing of the normalized ith time point acquisitionData of the j-th dimension of the data sample, u (Y _j ) And the mean value of the n' original training time sequence data samples in the j dimension, sigma (Y) _j ) Representing the variance of n' original test time series data samples in the j-th dimension;

s7.2, carrying out time interval extraction on the standardized original test time sequence data sample to obtain a test data sample, wherein the specific process is as follows:

let I be the extraction interval and L be the extraction length, then the first test data sample extracted is:

b ⁽¹⁾ ＝{y ^(*1) ，y ^(*2) ，...，y ^(*L) }

The kth test data sample extracted is expressed as:

b ^(k) ＝{y ^{(*(1+(k-1)I))} ，y ^{(*(2+(k-1)I))} ，....，y ^{(*(L+(k-1)I))} }

let N 'be the total number of extracted test data samples, then the last item of data of the N' th extracted test data sample:

it is known that the number of the components,

wherein n' is the number of sample data in the multi-dimensional time sequence data after the labeling and the tapering;

the set of N' test data samples is a test data set, denoted as:

B＝{b ⁽¹⁾ ，b ⁽²⁾ ，...，b ^(k) ，...，b ^(N′) }。

in a tenth embodiment, this embodiment is described with reference to fig. 1 and 2, and is a further limitation of step S8 in the anomaly detection method based on LSTM-AE and dynamic threshold adjustment described in the seventh embodiment, and specific implementation contents are as follows:

the step S8 specifically includes the following steps:

training data sample b in test data set A ^(k) As an input of the anomaly detection model, the corresponding reconstructed output sequence is:

wherein,the reconstruction output of the abnormality detection model at the time t is the same as the test data sample b ^(k) Y in (a) ^{(*(t+(k-1)I))} Correspondingly, record y ^{(*(t+(k-1)I))} Is y ^t Then y ^t The corresponding reconstruction errors are:

training data sample b ^(k) The corresponding error sequence is:

e′ _tr ＝{e′ ₁ ，e′ ₂ ，...，e′ _t ，...，e′ _L }

the reconstruction error e' _t And (3) giving the training data a reconstruction error parameter to obtain a value of an adaptive threshold.

In this embodiment, the abnormality detection model is the abnormality detection model described in any one of the foregoing embodiments.

An eleventh embodiment is described with reference to fig. 1 and 2, and the embodiment is a further limitation of step S9 in the anomaly detection method based on LSTM-AE and dynamic threshold adjustment described in the seventh embodiment, and specifically implemented as follows:

if the reconstruction error of the test data sample is larger than the self-adaptive error threshold, abnormal data appear in the corresponding test data sample, and the industrial system to be tested is proved to be abnormal.

A twelfth embodiment is a comparison test between the abnormality detection method according to the first embodiment and the conventional abnormality detection method based on LSTM-AE and dynamic threshold adjustment, and the specific test contents are as follows:

TABLE 1 comparison of test methods for multi-parameter anomalies

Experiments were performed on the TEP dataset according to the present invention, as shown in table 1, the 3 sigma-based method also achieved good detection results, due to the higher data discrimination in normal and abnormal conditions to some extent. However, the method provided by the invention still achieves further improvement compared with the 3 sigma method, and the final F1-Score reaches 100%. The method has higher adaptability.

In a thirteenth embodiment, this embodiment is described with reference to fig. 1 and 2, and provides an abnormality detection system, which is specifically implemented as follows:

the system comprises: a processor and a memory for storing executable instructions of the processor, the processor configured to perform an anomaly detection method based on LSTM-AE and dynamic threshold adjustment of any one of embodiments seven-eleven via execution of the executable instructions.

The technical solution provided by the present invention is described in further detail through several specific embodiments, so as to highlight the advantages and benefits of the technical solution provided by the present invention, however, the above specific embodiments are not intended to be limiting, and any reasonable modification and improvement, reasonable combination of embodiments, equivalent substitution, etc. of the present invention based on the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims (10)

1. The method for constructing the abnormality detection model is characterized by comprising the following steps of:

s1, under the stable operation condition of no abnormality of an industrial system to be detected, collecting data of a plurality of state parameters of the industrial system to be detected as original training time sequence data samples, wherein a set of the original training time sequence data samples is an original training time sequence data set of the industrial system in a no abnormality state;

S2, carrying out data preprocessing on the original training time sequence data samples to obtain training data samples, wherein a set of the training data samples is a training data set of the industrial system in a non-abnormal state;

s3, constructing a preliminary LSTM-AE model according to a self-encoder principle by utilizing long-time sequence modeling capability of the LSTM depth model;

s4, carrying out reconstruction training on the initial LSTM-AE model by utilizing the training data set, and optimizing a network weight value of the initial LSTM-AE model to obtain an error sequence of the trained LSTM-AE model and a training data sample;

s5, obtaining an adaptive threshold formula of the industrial system to be tested by utilizing the error sequence of the training data set, wherein the formula comprises a training data reconstruction error parameter, and a value of the adaptive threshold can be obtained by endowing the training data reconstruction error parameter with a value, and the value of the adaptive threshold is used for judging abnormal values to complete the construction of an abnormal detection model.

2. The method for constructing an anomaly detection model according to claim 1, wherein in the step S1:

the original training time sequence data sample is expressed as:

the original training time sequence data set is expressed as:

X＝{x ⁽¹⁾ ,x ⁽²⁾ ,…,x ⁽ⁱ⁾ ,…,x ⁽ⁿ⁾ }

Wherein,

i∈[1,n]，j∈[1,m]

where n represents the original training time sequence data sample acquired at n time points, m represents that the original training time sequence data sample is composed of m dimension characteristics,data representing the j-th dimension of the original training time series data sample acquired at the i-th time point.

3. The method for constructing an anomaly detection model according to claim 2, wherein the step S2 is specifically as follows:

s2.1, performing standard vertebral processing on the data of each dimension in the acquired original training time sequence data sample, and expressing the data as follows by a formula:

the normalized raw training time series data samples are expressed as:

the normalized raw training time series data set is expressed as:

X ^* ＝{x ^(*1) ,x ^(*2) ,…,x ^(*i) ,…,x ^(*n) }

wherein,

j∈[1,m]

in the method, in the process of the invention,data representing the j-th dimension of the original training time series data sample acquired at the i-th time point after normalization, u (X) _j ) Represents the mean value of n original training time sequence data samples in the j dimension, sigma (X) _j ) Representing the variance of n original training time sequence data samples in the j dimension;

s2.2, carrying out equal time interval extraction on the standardized original training time sequence data sample to obtain a training data sample, wherein the specific process is as follows:

let I be the extraction interval and L be the extraction length, then the first training data sample extracted is:

a ⁽¹⁾ ＝{x ^(*1) ,x ^(*2) ,…,x ^(*L) }

The kth training data sample extracted is represented as:

a ^(k) ＝{x ^{(*(1+(k-1)I))} ,x ^{(*(2+(k-1)I))} ,…,x ^{(*(L+(k-1)I))} }

let N be the total number of extracted training data samples, then the last item of data of the nth extracted training data sample:

wherein,

the set of N training data samples is a training data set, denoted as:

A＝{a ⁽¹⁾ ,a ⁽²⁾ ,…,a ^(k) ,…,a ^(N) }。

4. the method for constructing an anomaly detection model according to claim 3, wherein the step S3 is specifically as follows:

the primary LSTM-AE model is divided into three layers, wherein two layers belong to an LSTM layer, and the other layer belongs to a linear full-connection layer;

the two LSTM layers are respectively an encoding layer and a decoding layer;

the dimension of the input parameters and the dimension of the output parameters of the coding layer, the decoding layer and the linear full-connection layer are set to be m, namely the dimension is the same as the dimension of the data sample input into the primary LSTM-AE model;

the coding layer is composed of L LSTM units, each LSTM unit of the coding layerRepresenting the coding hiding state at the time t;

the decoding layer is also composed of L LSTM units, each LSTM unit of the decoding layerRepresenting a decoding hidden state at the time t;

in the forward propagation of the neural network, the decoding hidden state of the decoding layer is set to be the same as the encoding hidden state of the encoding layer, i.e. at t=l When t is more than or equal to 1 and less than or equal to L-1, setting the decoding hidden state of the decoding layer as +.>Wherein F is _D Representing the operation of the decoding layer LSTM unit, < >>Decoding hidden state of decoding layer at time t+1, x ^t The method comprises the steps of inputting a preliminary LSTM-AE model corresponding to a middle t moment;

setting decoding hidden state of decoding layerThe input of the linear full-connection layer t moment is the output of the linear full-connection layer t moment is +.>I.e. the reconstruction output corresponding to the t moment of the preliminary LSTM-AE model, f represents the activation function, and w and b are bothNetwork weight values for the preliminary LSTM-AE model.

5. The method for constructing an anomaly detection model according to claim 4, wherein the step S4 is specifically as follows:

s4.1, constructing a neural network loss function, wherein the specific process is as follows:

training data sample a in training data set A ^(k) As input to the preliminary LSTM-AE model, the corresponding reconstructed output sequence is:

wherein,for the reconstruction output at time t, which is associated with training data sample a ^(k) X in (2) ^{(*(t+(k-1)I))} Correspondingly, record x ^{(*(t+(k-1)I))} Is x ^t The constructed neural network loss function is:

s4.2, carrying out reconstruction training on the preliminary LSTM-AE model, and updating and optimizing a network weight value, wherein the specific process is as follows:

setting a predefined training frequency, sequentially inputting all training data samples in the training data set A into the initial LSTM-AE model in a circulating way, taking the minimized neural network loss function as a target, updating the optimized network weight value, and when the circulating frequency reaches the predefined training frequency, finishing training to obtain the trained LSTM-AE model.

S4.3, after training is finished, training data sample a in training data set A ^(k) As input to the trained LSTM-AE model, the corresponding reconstructed output sequence is:

wherein,for the reconstruction output of the trained LSTM-AE model at the time t, the reconstruction output is matched with the training data sample a ^(k) X in (2) ^{(*(t+(k-1)I))} Correspondingly, record x ^{(*(t+(k-1)I))} Is x ^t X is then ^t The corresponding reconstruction errors are:

training data sample a ^(k) The corresponding error sequence is:

e _tr ＝{e ₁ ,e ₂ ,…,e _t ,…,e _L }。

6. the method for constructing an anomaly detection model according to claim 5, wherein the step S5 is specifically as follows:

s5.1, calculating a calculation formula of an error threshold, wherein the formula comprises a parameter anomaly probability value q to be set, and the specific process is as follows:

calculating the distribution of extreme values in the error sequence of the training data set, wherein the formula is as follows:

wherein,

γ∈R，1+γx>0

wherein x is the data in the error sequence; gamma is an extremum coefficient that depends on the initial distribution of the error sequence data;

fitting the distribution of extrema in the error sequence using a method based on the second polar value theorem, if and only if σ is present, then for x εR and 1+γx > 0:

wherein F is _t (X) represents the cumulative distribution function of X, t is the initial threshold, and X-t is the fraction exceeding the threshold t; the extreme value distribution accords with generalized pareto distribution at the X-t part, and the extreme value is fitted to the X-t part by using the generalized pareto distribution based on the second extreme value theorem; wherein the estimation of extremum coefficients gamma and sigma is obtained by using a maximum likelihood method and expressed as And->Obtaining a calculation formula of an error threshold value:

wherein N is _t Representing the number of X-T, n is the number of data, q is the abnormal probability value, and the error threshold T can be obtained by setting the value of the abnormal probability value q _tr ；

S5.2, automatically acquiring an optimal abnormal probability value through a formula method, setting an abnormal probability value q in a calculation formula of an error threshold value as the optimal abnormal probability value, and calculating to obtain the error threshold value T _tr The specific process is as follows:

the determination of the abnormal probability value q is equivalent to an optimization process, and the optimization target and the calculation process are as follows:

wherein T is _tr Is an error threshold; e, e _tr Is an error sequence; Δμ (e) _tr ) And delta sigma ² (e _tr ) Representing the variation of the mean and variance of the error sequence after removing the outliers; i e _a The number of anomalies is represented by the number of anomalies, which can be interpreted as q-value determination targeting the removal of data exceeding a threshold, such that e _tr The value at which the mean and standard deviation decay is greatest;

when the first formula isWhen the value of the abnormal probability value q in the formula is the maximum value, the value of the abnormal probability value q is the optimal abnormal probability value;

in the calculation formula of the error threshold value, setting the abnormal probability value q to be equal to the optimal abnormal probability value to obtain the error threshold value T _tr ；

S5.3 adaptive thresholdThe formula is:

wherein epsilon is a coefficient; η is a hyper-parameter coefficient; t (T) _rc Reconstructing error parameters for training data, the error threshold T may be determined by assigning different values to the training data reconstruction error parameters _tr And carrying out real-time adjustment.

7. An anomaly detection method based on LSTM-AE and dynamic threshold adjustment is characterized by comprising the following steps:

s6, under the working condition of the industrial system to be tested, collecting real-time data of a plurality of state parameters of the industrial system to be tested as original test time sequence data samples, wherein a set of the original test time sequence data samples is an original test time sequence data set of the industrial system to be tested;

s7, carrying out data preprocessing on the collected original test time sequence data samples to obtain test data samples, wherein a set of the test data samples is a test data set under a to-be-tested state of the industrial system;

s8, taking the test data samples as input of an anomaly detection model, calculating a reconstruction error and an error sequence of each test data sample, and giving the reconstruction error value of the test data samples to the training data reconstruction error parameter to obtain a self-adaptive threshold value; the abnormality detection model is constructed by adopting the construction method of any one of claims 1 to 6;

s9, comparing the size relation between the reconstruction error of the test data sample and the value of the self-adaptive threshold value, and judging whether the industrial system to be tested is abnormal or not.

8. The anomaly detection method based on LSTM-AE and dynamic threshold adjustment according to claim 7, wherein in step S6:

the original test time sequence data sample is expressed as:

the raw test time series data set is expressed as:

Y＝{y ⁽¹⁾ ,y ⁽²⁾ ,…,y ⁽ⁱ⁾ ,…,y ⁽ⁿ⁾ }

wherein,

i∈[1,n′]，j∈[1,m]

where n 'represents the original test time series data sample acquired at n' time points, m represents that the original test time series data sample is composed of m dimensional features,data representing the j-th dimension of the original test time series data sample acquired at the i-th time point.

9. The anomaly detection method based on LSTM-AE and dynamic threshold adjustment according to claim 8, wherein the step S7 is specifically as follows:

s7.1, performing standard vertebral processing on the data of each dimension in the acquired original test time sequence data sample, wherein the standard vertebral processing is expressed as follows:

the normalized raw test time series data samples are expressed as:

the normalized raw training time series data set can be expressed as:

Y ^* ＝{y ^(*1) ,y ^(*2) ,…,y ^(*i) ,…,y ^(*n′) }

wherein,

j∈[1,m]

in the method, in the process of the invention,data representing the j-th dimension of the raw test time series data sample acquired at the i-th point in time after normalization, u (Y) _j ) And the mean value of the n' original training time sequence data samples in the j dimension, sigma (Y) _j ) Representing the variance of n' original test time series data samples in the j-th dimension;

s7.2, carrying out time interval extraction on the standardized original test time sequence data sample to obtain a test data sample, wherein the specific process is as follows:

let I be the extraction interval and L be the extraction length, then the first test data sample extracted is:

b ⁽¹⁾ ＝{y ^(*1) ,y ^(*2) ,…,y ^(*L) }

the kth test data sample extracted is expressed as:

b ^(k) ＝{y ^{(*(1+(k-1)I))} ,y ^{(*(2+(k-1)I))} ,…,y ^{(*(L+(k-1)I))} }

let N 'be the total number of extracted test data samples, then the last item of data of the N' th extracted test data sample:

it is known that the number of the components,

wherein n' is the number of sample data in the multi-dimensional time sequence data after the labeling and the tapering;

the set of N' test data samples is a test data set, denoted as:

B＝{b ⁽¹⁾ ,b ⁽²⁾ ,…,b ^(k) ,…,b ^(N′) }。

10. an anomaly detection system, the system comprising: a processor and a memory, wherein the memory is configured to store executable instructions of the processor, the processor being configured to perform an anomaly detection method based on LSTM-AE and dynamic threshold adjustment as claimed in any one of claims 7 to 9 via execution of the executable instructions.