CN-121436976-B - Operation and maintenance anomaly detection method and system based on core set selection

CN121436976BCN 121436976 BCN121436976 BCN 121436976BCN-121436976-B

Abstract

Collecting a plurality of operation and maintenance time sequence samples, taking each operation and maintenance time sequence sample as a space domain representation, respectively performing fast Fourier transform to obtain a corresponding frequency domain representation, inputting the frequency domain representation and the space domain representation into a teacher model and a student model, and obtaining abnormal prediction distribution of the frequency domain and the space domain; the method comprises the steps of calculating JS divergence between abnormal prediction distribution of a frequency domain and an airspace, weighting and fusing the JS divergence to serve as a double-domain collaborative distillation score, selecting operation and maintenance time sequence samples with the double-domain collaborative distillation score higher than a dynamic sparse gating threshold as candidate sets, constructing diversity constraint, selecting the first S operation and maintenance time sequence samples from the candidate samples meeting the diversity constraint to form a core set, training a student model by taking the core set as training data and a teacher model as distillation sources, deploying the trained student model to edge equipment, and carrying out local abnormal detection on the input operation and maintenance time sequence data.

Inventors

YUAN JINGLING
YAO QUANFENG
TONG YUJIA
LI WANG
HUANG WEI
SUN JIE

Assignees

武汉理工大学
武汉烽火技术服务有限公司
烽火通信科技股份有限公司
内蒙古大学

Dates

Publication Date: 20260508
Application Date: 20251229

Claims (7)

1. The operation and maintenance abnormality detection method based on core set selection is characterized by comprising the following steps: Step S1, collecting operation and maintenance data of each device at fixed time intervals to form a plurality of operation and maintenance time sequence samples, taking each operation and maintenance time sequence sample as an original airspace representation and respectively performing fast Fourier transform to obtain a corresponding frequency domain representation, respectively inputting the frequency domain representation and the original airspace representation into a full-precision double-flow teacher model and a quantized double-flow student model, and obtaining abnormal prediction distribution of a frequency domain and an airspace; Step S2, JS divergence between abnormal prediction distribution of a full-precision double-flow teacher model and a quantized double-flow student model in a frequency domain and a space domain is calculated, weighted and fused to be used as a double-domain collaborative distillation score of a corresponding operation and maintenance time sequence sample, all the operation and maintenance time sequence samples are arranged according to a descending order of the double-domain collaborative distillation score, and the expression of the double-domain collaborative distillation score is as follows: ; in the formula, Scoring the dual domain co-distillation; 、 in order for the weights to be adaptive, In the training process, alpha and beta are dynamically updated according to the relative gradient change of the distillation loss of the frequency domain and the airspace; 、 the abnormal prediction distribution of the full-precision double-flow teacher model in the frequency domain and the airspace is respectively; 、 Respectively quantifying abnormal prediction distribution of the double-flow student model in a frequency domain and a space domain; indicating that JS divergence is calculated; Step S3, introducing a dynamic sparse gating threshold, selecting an operation and maintenance time sequence sample with a double-domain collaborative distillation score higher than the dynamic sparse gating threshold as a candidate set, constructing diversity constraint by taking uniform coverage of the operation and maintenance time sequence sample in a time sequence shape, spectrum energy and abnormal class three-dimensional space as a target, and selecting the first S operation and maintenance time sequence samples from the candidate samples meeting the diversity constraint to form a core set, wherein the dynamic sparse gating threshold is expressed as follows: ; in the formula, A dynamic sparse gating threshold; A threshold value is gated for initial sparsity; the training is performed for the current training round; Is the total training round; Constructing a diversity constraint includes the steps of: Step S31, adopting a random projection function family based on cosine similarity as a local sensitive hash family: ; in the formula, Is the first Hash values of the hash functions on the samples x; A random vector sampled from a standard gaussian distribution; Representing the calculated cosine similarity; Step S32, distributing operation and maintenance time sequence samples into different hash buckets according to hash codes, wherein each hash bucket represents a type of local similar sample set; S33, selecting one or a plurality of samples from each non-empty hash bucket according to a double-domain collaborative distillation scoring priority principle; And S4, training the quantized double-flow student model by taking the core set as training data and the full-precision double-flow teacher model as a distillation source, deploying the trained quantized double-flow student model to edge equipment, and carrying out local anomaly detection on the input operation and maintenance time sequence data.
2. The method for detecting operation and maintenance anomalies based on core set selection as set forth in claim 1, wherein training the quantitative dual-stream student model in step S4 comprises the steps of: Step S41, introducing a learnable sparse gating factor into each layer of convolution or attention module of the quantized double-flow student model; step S42, adopting a pseudo-norm regularization term to induce the sparse gating factor, and constructing a total loss function according to the double-domain collaborative distillation loss and the dynamic sparse regularization loss; And S43, jointly optimizing the total loss function through a gradient descent algorithm to realize the channel-time axis sparse control of layer-by-layer self-adaption.
3. The method for detecting operation and maintenance anomalies based on core set selection as set forth in claim 2, wherein the sparse gating factor in step S41 has the expression: ; in the formula, Is a sparse gating factor; Is the first Layer number Scalar gating coefficients corresponding to the channels; Representation of Pseudo-norms.
4. The method for detecting operation and maintenance anomalies based on core set selection according to claim 2, wherein the expression of the total loss function in step S43 is: ; in the formula, As a total loss function; detecting a task loss for an anomaly; Is a balance super parameter; A sparse gating factor vector for a first layer; Representation of Pseudo-norms.
5. The operation and maintenance anomaly detection method based on core set selection is characterized in that in step S4, after a trained quantized double-flow student model is deployed to edge equipment, real-time resource budget of the edge equipment is monitored in operation, according to a comparison result of the real-time resource budget and a preset threshold, the threshold of the sparse gating factor is recalibrated online, when the real-time resource budget is larger than the preset threshold, the threshold of the sparse gating factor is increased to enhance sparsity, and when the real-time resource budget is smaller than the preset threshold, the threshold of the sparse gating factor is lowered to recover more channels.
6. The method for detecting operation and maintenance anomalies based on core set selection as set forth in claim 5, wherein the real-time resource budget is obtained by comprehensively evaluating real-time CPU/GPU utilization, memory occupancy and residual capacity of the device.
7. An operation and maintenance abnormality detection system based on core set selection, which is realized based on the operation and maintenance abnormality detection method based on core set selection according to any one of the claims 1-6, and is characterized by comprising an operation and maintenance time sequence sample acquisition module, a double-domain collaborative distillation scoring module, a dynamic sparse core set construction module, a dynamic sparse gate control training module and an edge deployment module; the operation and maintenance time sequence sample acquisition module acquires operation and maintenance data of each device at fixed time intervals to form a plurality of operation and maintenance time sequence samples; mapping operation and maintenance time sequence samples to a frequency domain through fast Fourier transformation, simultaneously reserving an original airspace sequence to form a frequency-space double-domain parallel representation, respectively carrying out abnormal probability prediction on the two representations through a full-precision double-flow teacher model and a quantized double-flow student model, calculating JS divergence between abnormal prediction distribution output by the teacher-student model in the frequency domain and the airspace, and carrying out weighted fusion according to self-adaptive weight to generate a double-domain collaborative distillation score; Introducing a dynamic sparse gating threshold, selecting an operation and maintenance time sequence sample with a double-domain collaborative distillation score higher than the dynamic sparse gating threshold as a candidate set, constructing diversity constraint by taking uniform coverage of the operation and maintenance time sequence sample in a time sequence shape, spectrum energy and abnormal class three-dimensional space as a target, and selecting the first S samples from the candidate samples meeting the diversity constraint to form a core set; The dynamic sparse gate control training module is used for training the quantized double-flow student model by taking the core set as training data and the full-precision double-flow teacher model as a distillation source; The edge deployment module deploys the quantized double-flow student model after training to edge equipment and carries out local anomaly detection on the input operation and maintenance time sequence data.

Description

Operation and maintenance anomaly detection method and system based on core set selection Technical Field The invention belongs to the field of operation and maintenance abnormality detection, and particularly relates to an operation and maintenance abnormality detection method and system based on core set selection. Background With the continuous expansion of the scale of infrastructure such as data centers, electric power, communication networks and the like, operation and maintenance anomaly detection becomes a key link for guaranteeing stable operation of the system. In practical application, the operation and maintenance data often contains a large amount of sensitive information, such as an equipment operation log, a user access record and the like, if the operation and maintenance data are directly transmitted to the cloud, the privacy leakage risk exists, and higher network delay and bandwidth consumption are brought, so that an operation and maintenance abnormality detection model is deployed to the edge equipment, localized real-time detection is realized, and the operation and maintenance abnormality detection model becomes an important direction of current research. When an operation and maintenance anomaly detection model is deployed in an edge computing environment, research has been attempted to compress the model by adopting methods such as core set selection and knowledge distillation so as to adapt to resource constraint of edge equipment. Although the prior art solves the problem of resource adaptation of the model deployed on the edge device to a certain extent, multiple bottlenecks are still faced in practical application. The edge equipment is generally limited by calculation and storage resources, a training mode of a traditional full-quantity data and full-precision model is difficult to bear, so that real-time performance and energy consumption indexes cannot meet the severe requirements of an operation and maintenance site, and secondly, the operation and maintenance log, monitoring indexes, alarm information and other data often comprise sensitive service details or user privacy, and the cloud directly uploaded not only violates a data compliance policy, but also possibly brings additional network delay and bandwidth pressure, so that closed loop processing must be completed locally. The existing core set selection and knowledge distillation method focuses on static loss contribution or layer-by-layer alignment, ignores complementarity of time sequence data on frequency domain and space domain representation, and also does not fully mine self-adaptive inhibition of sparse gating on quantization errors. Therefore, a set of lightweight training frames for operation and maintenance scenes is needed, and privacy protection, calculation efficiency and detection accuracy are considered on the premise of local data and local calculation. Disclosure of Invention The invention provides an operation and maintenance abnormality detection method and system based on core set selection, which solve the problem of lower calculation efficiency and detection precision when an existing operation and maintenance abnormality detection model is deployed in an edge calculation environment. In order to solve the technical problems, the invention provides an operation and maintenance abnormality detection method based on core set selection, which comprises the following steps: Step S1, collecting operation and maintenance data of each device at fixed time intervals to form a plurality of operation and maintenance time sequence samples, taking each operation and maintenance time sequence sample as an original airspace representation and respectively performing fast Fourier transform to obtain a corresponding frequency domain representation, inputting the frequency domain representation and the original airspace representation into a full-precision double-flow teacher model and a quantized double-flow student model at the same time, and obtaining abnormal prediction distribution of a frequency domain and an airspace; S2, calculating JS divergences between abnormal prediction distributions of a full-precision double-flow teacher model and a quantized double-flow student model in a frequency domain and a space domain, weighting and fusing the JS divergences to serve as double-domain collaborative distillation scores of corresponding operation and maintenance time sequence samples, and arranging all the operation and maintenance time sequence samples according to a descending order of the double-domain collaborative distillation scores; Step 3, introducing a dynamic sparse gating threshold, selecting operation and maintenance time sequence samples with double-domain collaborative distillation scores higher than the dynamic sparse gating threshold as candidate sets, constructing diversity constraint by taking uniform coverage of the operation and maintenance time sequence samples in a time sequence shape, spec