Search

CN-121980468-A - Multi-dimensional time sequence anomaly detection method based on self-adaptive packet expert network

CN121980468ACN 121980468 ACN121980468 ACN 121980468ACN-121980468-A

Abstract

The invention discloses a multidimensional time sequence anomaly detection method based on a self-adaptive packet expert network, and belongs to the technical field of time sequence analysis. The method comprises the steps of collecting and preprocessing time sequence data in the target field, automatically generating a channel grouping scheme suitable for the characteristics of a data set by carrying out channel correlation analysis and spectral clustering on a complete training set, constructing a sliding window sample, dividing the sliding window data into a plurality of channel groups according to the grouping scheme, independently inputting the data of each channel group into a dedicated group expert network for reconstruction, aggregating the reconstruction results of all groups to obtain a final reconstruction sequence, calculating reconstruction errors between original data and reconstruction data, and judging abnormality according to a preset threshold value. The invention aims to solve the problems that the prior model cannot effectively distinguish variable correlation and time sequence mode heterogeneity, so that good reconstruction is generated on normal data and abnormal data, the reconstruction error gap is difficult to be enlarged, and the report missing rate is high.

Inventors

  • HUANG JUN
  • Tian Qinhao

Assignees

  • 安徽工业大学

Dates

Publication Date
20260505
Application Date
20260319

Claims (10)

  1. 1. The multi-dimensional time sequence anomaly detection method based on the self-adaptive packet expert network is characterized by comprising the following steps of: model construction and training phase: s1, collecting and preprocessing multichannel time sequence data in the target field to form a training set, a verification set and a test set; s2, carrying out channel correlation analysis and spectral clustering on the training set, and automatically generating a global and static channel grouping scheme; s3, constructing K exclusive group expert networks based on the channel grouping scheme to form an anomaly detection model; S4, training the anomaly detection model by using the training set, and determining a reconstruction error judgment threshold value of the model by using the verification set; abnormality detection stage: s5, acquiring a multi-channel time window sequence to be detected, and constructing a sliding window sample; s6, dividing the sliding window sample into K independent channel group data subsets in the channel dimension according to the channel grouping scheme generated in the step S2; S7, inputting the K channel group data subsets into K special group expert networks corresponding to the trained abnormal detection model, carrying out feature extraction and signal reconstruction in parallel, and aggregating reconstructed signals of all channel groups to obtain a complete reconstruction sequence of the window sequence to be detected; s8, calculating a reconstruction error between the window sequence to be detected and the complete reconstruction sequence; s9, comparing the calculated reconstruction error with the judgment threshold value determined in the step S4, if the reconstruction error is larger than the judgment threshold value, judging that the window to be detected is abnormal, otherwise, judging that the window to be detected is normal.
  2. 2. The method for detecting multidimensional time series anomalies based on adaptive packet expert network according to claim 1, wherein in step S2, the automatically generating a channel packet scheme specifically comprises: Calculating pearson correlation coefficients among all channels in a training set, constructing a correlation matrix, and taking absolute values of the correlation matrix to obtain an affinity matrix; And inputting the affinity matrix into a spectral clustering algorithm, presetting the number of target clusters as the preset group number K, outputting a group index for each channel, and forming the channel grouping scheme by the group indexes of all channels together.
  3. 3. The method for detecting multi-dimensional time series anomalies based on adaptive packet expert networks according to claim 1, wherein in step S7, each of said dedicated packet expert networks processes a subset of input channel group data, including: S7.1, carrying out multi-scale decomposition on an input channel group data subset, and dividing a time sequence into M groups of non-overlapping fragment sets with different scales in a time dimension by setting M different fragment lengths; s7.2, mapping M groups of fragment sets with different scales to hidden spaces with uniform dimensions through M independent linear embedding layers to obtain M groups of embedded feature tensors; S7.3, respectively modeling the Granger causal relationship of the M groups of embedded feature tensors through M mutually independent scale encoders to obtain M groups of coded features; S7.4, carrying out scale alignment on the M groups of coding features, and carrying out weighted fusion based on an attention mechanism to obtain fusion features; and S7.5, inputting the fusion characteristics into a sparse hybrid expert network for decoding and reconstructing to obtain a reconstructed signal of the channel group.
  4. 4. The method for detecting the abnormality of the multidimensional time series based on the adaptive packet expert network according to claim 3, wherein in the step S7.3, each scale encoder is formed by stacking L layers of processing layers, each layer of processing layers comprises a sparse causal self-attention module and a forward feedback neural network, the sparse causal self-attention module realizes causality constraint through a mask matrix, the constraint enables the current position in the sequence to access all channel elements with the time not later than that of the current segment, the forward feedback neural network module comprises two linear layers and a nonlinear activation function positioned between the two linear layers, and the output of the forward feedback neural network module is connected with the input of the forward feedback neural network module in a residual mode and normalized by the layers.
  5. 5. The method for detecting multidimensional time series anomalies based on adaptive packet expert network according to claim 4, wherein in step S7.4, the weighted fusion is performed based on an attention mechanism, and the method specifically comprises the following steps: the scale alignment, namely expanding the coding features of the other scales to the reference number in the segment number dimension by copy operation by taking the scale with the largest segment number in M scales as the reference, so as to obtain M groups of aligned features with the same shape; the M groups of aligned features are spliced along feature dimensions, the spliced tensors are input into a gating network, and a weight tensor is generated after the gating network processing and Softmax function normalization; and (3) weighting and fusing, namely weighting and summing the M groups of aligned features by using the weight tensor to obtain the fused features.
  6. 6. The method for detecting the multidimensional time series anomaly based on the adaptive packet expert network according to claim 5, wherein in the step S7.5, the sparse hybrid expert network comprises a routing network and E decoding expert networks, wherein the routing network is realized by a linear layer and is used for mapping the input fusion characteristics into a fractional tensor representing the distribution of the E decoding expert networks; Each decoding expert network is a forward feedback neural network, and the output dimension of each decoding expert network is a preset minimum segment length; for each eigenvector, its output is a weighted sum of the assigned k decoding expert network outputs with the routing weight as a coefficient.
  7. 7. The method for detecting multi-dimensional time series anomalies based on adaptive packet expert network as set forth in claim 6, wherein in step S7.5, after obtaining the weighted sum, the latter two dimensions of the weighted sum result tensor are combined through a flattening operation to recover the original time series length, so as to obtain the reconstructed signal of the channel group.
  8. 8. The method for detecting multi-dimensional time series anomalies based on the adaptive packet expert network according to claim 1 or 3, wherein in step S7, the reconstructed signals of all channel groups are aggregated, specifically, a reconstructed signal subset from K dedicated group expert networks is received, and the K reconstructed signal subsets are aggregated along a channel dimension according to a channel index sequence in an original sliding window sample by a channel aggregation operation, so as to generate a final reconstructed sequence identical to an input sample dimension.
  9. 9. The method for detecting the anomaly in the multi-dimensional time sequence based on the adaptive packet expert network according to claim 1, wherein the anomaly detection model is trained in an end-to-end mode, and the total loss function of the anomaly detection model is formed by weighting a reconstruction loss and an expert load balancing loss, wherein the reconstruction loss is used for measuring the difference between a reconstruction sequence and an original input sample, and the expert load balancing loss is used for encouraging a routing network to uniformly distribute calculation loads to all decoding expert networks.
  10. 10. The method for detecting the multi-dimensional time series anomalies based on the adaptive packet expert network according to claim 9, wherein the reconstruction loss is calculated by means of a mean square error, and the expert load balancing loss is calculated according to the proportion of eigenvectors routed to each decoding expert network and the average probability that the routing network distributes to each decoding expert network.

Description

Multi-dimensional time sequence anomaly detection method based on self-adaptive packet expert network Technical Field The invention belongs to the technical field of time sequence analysis, and particularly relates to a multi-dimensional time sequence anomaly detection method based on a self-adaptive packet expert network. Background The multidimensional time sequence anomaly detection is a key technology for guaranteeing stable operation of modern complex systems, and is particularly important in industrial Internet of things scenes. In modern manufacturing, energy and aerospace high-end industrial systems, core devices are typically deployed with a large number of sensors for continuously monitoring various physical quantities such as temperature, pressure, vibration, rotational speed and flow. These parallel data streams, which represent the time-dependent changes of a single physical quantity, are often referred to in the art as "channels". Each channel represents a particular dimension of the device's operational state. Since the devices are coupled systems that follow an inherent physical law, the channels are not independent of each other, but often form functional subsystems or associations. Therefore, the core task in the field of industrial internet of things is to accurately identify minor abnormal events indicating system faults or potential attacks from the high-dimensional data streams formed by the multiple channels. Whether these events deviate significantly from the normal behavior pattern can be successfully identified has an irreplaceable value for preventing significant economic losses and ensuring system safety. A reconstruction model based on deep learning is one of the mainstream methods of current multidimensional time series anomaly detection. Such methods learn the distribution pattern of normal data by training a deep neural network (e.g., a self-encoder). The basic assumption is that the model can reconstruct normal data learned in the training set well, while larger reconstruction errors can occur for abnormal data that have not been seen. By setting a proper threshold, the abnormality can be judged according to the size of the reconstruction error. However, the existing anomaly detection method based on reconstruction still faces the following two core technical bottlenecks when processing a complex multidimensional time sequence: First, in processing multidimensional time series, existing models typically employ a "channel dependent" strategy, i.e., processing data for all channels simultaneously within a unified structure of the model in an attempt to capture correlations between variables. The first purpose of this strategy is to use the information provided by the relevant variables to assist the decision, but in practical applications, complex, nonlinear, and even dynamically changing dependencies often exist between multiple channels, including both strong correlations that are beneficial to the decision, and weak correlations or irrelevances that are largely useless or even interfering. The existing model lacks an effective mechanism to distinguish and isolate the different correlations, so that the model possibly learns an excessively strong general representation for fitting the complex joint distribution of all channels, so that the model can generate a good reconstruction effect on partial abnormal data, limits the difference of reconstruction errors between normal and abnormal samples, and further causes a higher abnormal report missing rate. Second, a single time series itself tends to exhibit significant heterogeneity, i.e., multiple different local patterns, such as periodicity, trending, abrupt changes, or fluctuations of different frequencies, may be exhibited over different time periods. Existing reconstruction models typically employ a single receptive field or fixed network structure to process the data throughout the time window, making it difficult to simultaneously adapt and capture these multiscale, dynamically changing local patterns. This single view approach limits the model's ability to model the fine nature of the complex internal structure of normal data, thereby affecting its ability to distinguish subtle anomalies. Disclosure of Invention 1. Technical problem to be solved by the invention In order to overcome the defects in the prior art, the invention provides a multi-dimensional time sequence anomaly detection method based on an adaptive packet expert network. The invention carries out global channel grouping by analyzing the inherent correlation of the training data set channels, and statically divides the high-dimensional channels into a plurality of independent low-dimensional channel groups so as to isolate irrelevant variable interference, thereby enabling the grouping structure to be automatically adjusted along with the special correlation modes of different data sets. On the basis, the invention designs a dedicated group expert network