CN115423048B - A traffic flow anomaly detection method and system based on pattern similarity - Google Patents

Abstract

The invention discloses a traffic flow anomaly detection method and a system based on pattern similarity, which relate to the technical field of traffic flow anomaly detection models and comprise the following steps: extracting time sequence characteristics from traffic flow data by adopting an improved long-short-term memory neural network; dividing and clustering traffic flow data by adopting a sliding window, and taking a short-term sequence corresponding to a clustering center as a mode characteristic; calculating time sequence similarity for time sequence features of different space positions; determining the mode characteristics closest to each mode characteristic, and weighting the nearest neighbor distances of the mode characteristic pairs to obtain the mode similarity of different spatial positions; determining sequence similarity according to the time sequence similarity and the mode similarity, and constructing traffic flow dynamic relation diagrams of different time and different space positions according to the sequence similarity; and detecting abnormal traffic flow states by adopting a traffic flow dynamic relation diagram and time sequence similarity so as to improve the accuracy of detecting abnormal traffic flow.

Description

A traffic flow anomaly detection method and system based on pattern similarity

technical field

The invention relates to the technical field of traffic flow anomaly detection models, in particular to a traffic flow anomaly detection method and system based on pattern similarity.

Background technique

With the relevant development of big data technology, artificial intelligence technology is widely used in traffic flow anomaly detection and traffic flow forecasting. Accurate detection of traffic flow anomalies can not only provide favorable decision-making references for traffic management departments, but also provide travel information. People choose more suitable routes, which is conducive to alleviating traffic pressure.

The change of traffic flow at intersections is affected by time, weather, traffic policies, etc., and has obvious periodicity. The existing traffic flow anomaly detection algorithm using machine learning methods has at least the following three problems:

(1) A single cyclic neural network model cannot extract the information of the historical sequence of traffic flow more effectively.

(2) Existing traffic flow anomaly detection only considers the traffic conditions of a single intersection, and does not consider the associated influencing factors of other intersections.

(3) There is a lack of an effective measurement method when calculating the similarity of traffic flow between different intersections.

Contents of the invention

In order to solve the above problems, the present invention proposes a traffic flow anomaly detection method and system based on pattern similarity, which extracts time-series features and pattern features from traffic flow data, and constructs a traffic flow dynamic relationship diagram, so as to detect traffic flow anomalies Make judgments to improve the accuracy of traffic flow anomaly detection.

In order to achieve the above object, the present invention adopts the following technical solutions:

In a first aspect, the present invention provides a traffic flow anomaly detection method based on pattern similarity, including:

Obtain traffic flow data;

The improved long-short-term memory neural network is used to extract time-series features from traffic flow data; the improved long-short-term memory neural network obtains time-series features after weighted summation of hidden states obtained at different times;

Segment the traffic flow data with a sliding window to obtain a short-term sequence set. After clustering the short-term sequence set, the short-term sequence corresponding to the cluster center of each category is used as the pattern feature;

Calculate the temporal similarity of temporal features at different spatial locations;

Determine the pattern feature with the closest distance to each pattern feature to form a pattern feature pair, and after weighting the nearest neighbor distance of the pattern feature pair, the pattern similarity at different spatial positions is obtained;

The sequence similarity is determined according to the time series similarity and pattern similarity, and the dynamic relationship diagram of traffic flow at different times and different spatial locations is constructed according to the sequence similarity;

The abnormal state of traffic flow is detected by using the traffic flow dynamic relationship diagram and time series similarity.

As an optional implementation, in the process of weighting and summing the hidden states obtained at different times to obtain time series features, the weight is determined based on the correlation between the hidden states at different times and the traffic flow data , with a weight of:

in, is the traffic flow data on day t , for the hidden state, is the correlation function, is the parameter to be learned, is the number of days of the input traffic flow data, for the transpose operation.

As an optional implementation, the time series similarity is calculated for the time series features of different spatial positions The process is:

in, is the time series feature of spatial position a on the tth day, is the time series feature of spatial position b on the tth day, is the weight matrix to be learned And the network composed of the activation function tanh, Commander and to splice.

As an optional implementation manner, in the process of weighting the nearest neighbor distance of the pattern feature pair, the weight is the number of elements contained in the category of the pattern feature.

As an optional implementation manner, the sequence similarity is determined by summing the time sequence similarity and the pattern similarity after weighting.

As an optional implementation, the process of constructing the traffic flow dynamic relationship diagram includes:

According to the sequence similarity of traffic flow data at different spatial locations, construct the relationship diagram of different spatial locations at the same time ;

Introduce the connection relationship matrix between the traffic flow data in different spatial locations, and construct the dynamic relationship diagram of traffic flow according to the relationship diagram and the connection relationship matrix ;

in, is the parameter to be learned, is the connectivity matrix, tanh is the activation function, and are the current moment and the moment indicated by the prior data, respectively, for the time difference, is a decreasing function.

As an optional implementation, the connectivity matrix is:

Among them, X _a is the traffic flow data of spatial position a , X _b is the traffic flow data of spatial position b , is the connectivity matrix between X _a and X _b .

In a second aspect, the present invention provides a traffic flow anomaly detection system based on pattern similarity, comprising:

a data acquisition module configured to acquire traffic flow data;

The timing feature extraction module is configured to use an improved long-short-term memory neural network to extract timing features from traffic flow data; the improved long-short-term memory neural network obtains timing features after weighted summation of hidden states obtained at different times;

The pattern feature extraction module is configured to use a sliding window to segment the traffic flow data to obtain a short-term sequence set, and after clustering the short-term sequence set, use the short-term sequence corresponding to the cluster center of each category as the pattern feature;

A timing similarity determining module configured to calculate timing similarity for timing features at different spatial locations;

The pattern similarity determination module is configured to determine the pattern feature with the closest distance to each pattern feature to form a pattern feature pair, and after weighting the nearest neighbor distance of the pattern feature pair, the pattern similarity of different spatial positions is obtained;

The dynamic relationship diagram building module is configured to determine the sequence similarity according to the time series similarity and the pattern similarity, and construct the dynamic relationship diagram of traffic flow at different times and different spatial locations according to the sequence similarity;

The anomaly detection module is configured to detect the abnormal state of the traffic flow by using the traffic flow dynamic relationship diagram and the time series similarity.

In a third aspect, the present invention provides an electronic device, including a memory, a processor, and computer instructions stored in the memory and run on the processor. When the computer instructions are executed by the processor, the method described in the first aspect is completed. .

In a fourth aspect, the present invention provides a computer-readable storage medium for storing computer instructions, and when the computer instructions are executed by a processor, the method described in the first aspect is completed.

Compared with prior art, the beneficial effect of the present invention is:

The present invention proposes a traffic flow anomaly detection method and system based on pattern similarity. The improved long-short-term memory neural network is used to extract time-series features. At the same time, pattern features are extracted to comprehensively consider the periodic characteristics of traffic flow data. The extracted After the similarity calculation of the two parts of the features, the traffic flow dynamic relationship diagram is constructed. The traffic flow dynamic relationship diagram considers the influence of the relationship between different spatial locations, and also considers the influence of different times on the current relationship, and finally uses the graph attention The network judges the abnormal situation of traffic flow to improve the accuracy of abnormal traffic flow detection.

Advantages of additional aspects of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Description of drawings

The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention, and the schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention.

Fig. 1 is the flowchart of the traffic flow anomaly detection method based on pattern similarity provided by Embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of the construction of the dynamic relationship diagram provided by Embodiment 1 of the present invention;

FIG. 3 is a flow chart of abnormality judgment provided by Embodiment 1 of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

It should be noted that the following detailed description is exemplary and intended to provide further explanation of the present invention. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

It should be noted that the terminology used here is only for describing specific embodiments, and is not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly dictates otherwise, the singular is intended to include the plural, and it should also be understood that the terms "comprising" and "having" and any variations thereof are intended to cover a non-exclusive Comprising, for example, a process, method, system, product, or device comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include steps or units not explicitly listed or for these processes, methods, Other steps or units inherent in a product or equipment.

In the case of no conflict, the embodiments and the features in the embodiments of the present invention can be combined with each other.

Example 1

This embodiment proposes a traffic flow anomaly detection method based on pattern similarity, as shown in FIG. 1 , including:

Obtain traffic flow data;

The improved long-short-term memory neural network is used to extract time-series features from traffic flow data; the improved long-short-term memory neural network obtains time-series features after weighted summation of hidden states obtained at different times;

Segment the traffic flow data with a sliding window to obtain a short-term sequence set. After clustering the short-term sequence set, the short-term sequence corresponding to the cluster center of each category is used as the pattern feature;

Calculate the temporal similarity of temporal features at different spatial locations;

Determine the pattern feature with the closest distance to each pattern feature to form a pattern feature pair, and after weighting the nearest neighbor distance of the pattern feature pair, the pattern similarity at different spatial positions is obtained;

The sequence similarity is determined according to the time series similarity and pattern similarity, and the dynamic relationship diagram of traffic flow at different times and different spatial locations is constructed according to the sequence similarity;

The abnormal state of traffic flow is detected by using the traffic flow dynamic relationship diagram and time series similarity.

In this embodiment, the traffic flow data in T days is defined as ; Among them, the traffic flow data on day t is , is the data of the nth minute of the t day, and N is the length of the intraday traffic flow data.

Since the traffic flow data is affected by many complex factors, in order to express its time-series features as a vector, this embodiment adopts an improved Long Short Term Memory neural network (Long Short Term Memory, LSTM) to model the acquired traffic flow data, to extract temporal features.

LSTM is an improved algorithm of recurrent neural network (RNN), and is widely used in time series modeling. The gating unit used in it can suppress the gradient disappearance problem of RNN to a certain extent. For each traffic flow data x ^t , the modeling formula of LSTM is shown in formula (1) - formula (6):

Input gate:

(1)

Forgotten Gate:

(2)

(3)

Output gate:

(4)

long memory:

(5)

short memory:

(6)

Among them, W _i , W _f , W _C and W _o are the parameters to be learned, C ^t is the state of the cell, is the intermediate quantity of the cell state, is the Hadamard product, h ^t is the hidden state. For the convenience of explaining the specific improved algorithm, the above formula ignores the offset term.

In most existing algorithms, the last hidden state h ^t is generally used as the output result of LSTM, but this often ignores the features contained in the previous hidden state.

For this reason, in this embodiment, the hidden states at different moments are fused in a weighted summation ^manner to obtain time-series features; wherein, the weight is defined by the correlation between the hidden states at different moments and xt , and the weight corresponding to the hidden state with a large correlation Significant, thereby improving the ability of the output to represent x ^t , as shown in formula (7) - formula (9):

(7)

(8)

(9)

in, for The weight of , calculated by the correlation function Decide; is the parameter to be learned.

After the above processing of all traffic flow data, the vector representation of x ^t is obtained, that is, the sequence feature v ^t ; the process is simplified to formula (10):

(10)

in, is the number of days to enter the data.

Pattern characteristics refer to a series of approximate short-term data that repeats on historical data. Therefore, this embodiment proposes a pattern feature extraction method based on segmentation and clustering to capture periodic features.

First, the traffic flow data is divided into several short-term sequences by using a sliding window; specifically:

Use the sliding window to divide the traffic flow data x ^t of day t into M windows to construct the short-term sequence set of day t ;in is a short-term sequence, L is the window length, M=N-L+1.

Then, the short-term sequence set is clustered according to the distance between the short-term sequences to capture the recurring short-term sequences, i.e. pattern features;

Concretely: integrating short-term series into collections in, through the All short-term series in clustering to capture pattern features;

belonging to the same category With approximate short-term series, take the cluster center of each category As the mode feature of the traffic flow data on day t , each element represents the cluster center of each category, and g is the number of categories.

In this embodiment, the similarity calculation is performed on the timing feature and the pattern feature respectively, and then the sequence similarity is determined according to the timing similarity and the pattern similarity, and the balance of the two similarities is controlled.

In this embodiment, the time series similarity between time series features of traffic flow data at different spatial locations (such as different traffic intersections) at the same time is calculated :

(11)

(12)

in, is the time series feature of spatial position a on the tth day, is the time series feature of spatial position b on the tth day, is the weight matrix to be learned And the network composed of the activation function tanh, Commander and to splice.

In this embodiment, the pattern characteristics of traffic flow data at all spatial locations are obtained After that, by calculating the traffic flow data of spatial location a pattern features and traffic flow data at spatial location b pattern features the distance between and , so as to determine the pattern similarity.

because There is no order relationship in itself, and and may contain different numbers of elements, resulting in and The corresponding relationship of the elements in is not easy to determine. In order to ensure the simplicity and robustness of the algorithm, this embodiment uses the calculation of the nearest neighbor distance of each pattern feature to solve the problem that there is no one-to-one correspondence between the trend pattern features of different traffic flow data sequences.

The nearest neighbor distance refers to the distance D _1NN between each pattern feature and its closest pattern feature, expressed as:

in, yes First a pattern feature, yes First a pattern feature;

Will is "1" when and The Euclidean distance between ,Will All elements in The nearest neighbor distances of are represented as an array ;

It is worth noting that when yes nearest neighbor time, maybe not nearest neighbor of

So, need to use and Respectively All elements in The nearest neighbor and All elements in nearest neighbor of

because and The distance metric between them is symmetric, and the and merged into ,in and respectively and The number of pattern features; Include and The nearest neighbor distance of all pattern features in , the problem is how to choose the most reasonable value to represent and distance between, if selected The largest value in , then in any The noise peaks appearing in will seriously affect the distance judgment, and if based on the minimum value, most There is almost no difference between them.

In order to consider the influence of all modes as much as possible, this embodiment chooses the All the values in are weighted to get the pattern similarity . structure and , respectively recorded the number of elements contained in the category of each pattern feature and , the same and merged into , then the weighting function is shown in formula (13):

(13)

in, for the summation operation.

In this embodiment, sequence similarity is determined according to time series similarity and pattern similarity , as shown in formula (14):

(14)

in, is the weight parameter to be learned, which is used to control the balance of the two similarities.

In this embodiment, the relationship diagrams of different spatial locations (traffic intersections) at the same time are constructed according to the sequence similarity, and then the relationship diagrams at different times are processed by LSTM based on dynamic diagrams to construct a dynamic relationship diagram of traffic flow including time series features;

Specifically, according to the sequence similarity of traffic flow data at different spatial locations, a relationship diagram of different spatial locations at the same time (like a day) is constructed , as shown in formula (15):

in, A relational graph built for day t , is the sequence similarity between the traffic flow data of spatial position a and spatial position b .

relation chart It can reflect the association relationship on day t , but ignores the influence of other times on the current association relationship. To this end, drawing on the gating structure of LSTM, we design a dynamic relationship graph construction method, as shown in Figure 2, named as Dynamic-based LSTM (Dynamic-based LSTM, DGLSTM), this part actually optimizes the input data, The corresponding specific formula is shown in formula (16):

(16)

in, is the parameter to be learned, is the connectivity relationship matrix between different spatial locations, which is used to guide the construction of dynamic relationship graphs, and its definition is shown in (17):

(17)

in, for the time difference, , and are the current moment and the moment indicated by the prior data, respectively; is a decreasing function for assigning prior data , and means The data in will be gradually forgotten as the time interval increases.

Then DGLSTM can be expressed as formula (18) - formula (23):

Input gate:

(18)

Forgotten Gate:

(19)

(20)

Output gate:

(twenty one)

long memory:

(twenty two)

short memory:

(twenty three)

After DGLSTM, the dynamic relationship diagram will be obtained ; relative to , It can not only reflect the correlation between the current time series, but also be affected by other time relationship diagrams in history. For ease of description, the The construction process of is expressed as formula (24):

(twenty four)

In this embodiment, Graph attention networks (Graph attention networks, GAT) are used to judge traffic flow anomalies. By aggregating the influence between approximate sequences, the implicit information in the dynamic relationship graph is captured. Compared with the traditional graph volume Based on the Graph Convolutional Networks (GCN) model, GAT can selectively aggregate the influence of approximate sequences, and the expression is shown in formula (25):

(25)

in, is the time series feature obtained by LSTM for the traffic flow data of the kth intersection; is the sequence similarity between intersection k and intersection p , and its size is the dynamic relationship graph The value of row k and column p ; is the weight matrix to be learned; the output of intersection k in GAT is hidden information ;

Obtain implicit information of all intersections through GAT The process can be expressed as formula (26):

(26)

When making exception judgments, define tags , using a single fully connected layer (Fullyconnected layer, FC) as the prediction function pair Forecast, as shown in Figure 3, the prediction formula is shown in formula (27):

(27)

in, is an abnormal result of judgment.

In this embodiment, cross-entropy is used to train the graph attention network, as shown in equation (28):

(28)

in, and are the real category and predicted value of intersection k at time t , respectively, and L is the loss function, which is used to minimize the gap between the predicted value and the real category.

Since anomaly detection is a typical classification task, this example uses the accuracy rate (Accuracy, ACC) and Matthews correlation coefficient (Matthews correlation coefficient, MCC), which are widely recognized in classification tasks, to evaluate the prediction effect of the graph attention network .

ACC can express the prediction effect of the model more intuitively, and the formula is shown in formula (29):

(29)

Among them, true positive (TP) is the result of normal prediction and true value; true negative (TN) is the result of abnormal prediction and true value; false positive (FP) is the result of prediction as normal but actually abnormal; A false negative (FN) is a result that is predicted to be abnormal but is actually normal.

MCC is an index to evaluate the performance of the model's two classifications. It is actually a correlation coefficient describing the actual classification and the predicted classification. Its value ranges between -1 and +1, with a coefficient of +1 indicating a perfect forecast, 0 indicating no better than random forecast, and -1 indicating complete inconsistency between forecast and observation. The calculation formula of MCC is shown in formula (30):

(30)

Combining the method of this embodiment with three traditional methods, namely Graph attention networks (Graph attention networks, GAT), temporal convolutional neural network (Temporal Convolutional Neural Network, TCN), gated recurrent unit neural network (Gated Recurrent Unit, GRU ) after comparison, the two indicators of the method of this embodiment are the highest, ranking first among the comparison methods, confirming the effectiveness of the method of this embodiment.

Example 2

This embodiment provides a traffic flow anomaly detection system based on pattern similarity, including:

a data acquisition module configured to acquire traffic flow data;

The timing feature extraction module is configured to use an improved long-short-term memory neural network to extract timing features from traffic flow data; the improved long-short-term memory neural network obtains timing features after weighted summation of hidden states obtained at different times;

The pattern feature extraction module is configured to use a sliding window to segment the traffic flow data to obtain a short-term sequence set, and after clustering the short-term sequence set, use the short-term sequence corresponding to the cluster center of each category as the pattern feature;

A timing similarity determining module configured to calculate timing similarity for timing features at different spatial locations;

The pattern similarity determination module is configured to determine the pattern feature with the closest distance to each pattern feature to form a pattern feature pair, and after weighting the nearest neighbor distance of the pattern feature pair, the pattern similarity of different spatial positions is obtained;

The dynamic relationship diagram building module is configured to determine the sequence similarity according to the time series similarity and the pattern similarity, and construct the dynamic relationship diagram of traffic flow at different times and different spatial locations according to the sequence similarity;

The anomaly detection module is configured to detect the abnormal state of the traffic flow by using the traffic flow dynamic relationship diagram and the time series similarity.

It should be noted here that the above modules correspond to the steps described in Embodiment 1, and the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1 above. It should be noted that, as a part of the system, the above-mentioned modules can be executed in a computer system such as a set of computer-executable instructions.

In further embodiments, there is also provided:

An electronic device includes a memory, a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the method described in Embodiment 1 is completed. For the sake of brevity, details are not repeated here.

It should be understood that in this embodiment, the processor can be a central processing unit CPU, and the processor can also be other general-purpose processors, digital signal processors DSP, application specific integrated circuits ASIC, off-the-shelf programmable gate array FPGA or other programmable logic devices , discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The memory may include read-only memory and random access memory, and provide instructions and data to the processor, and a part of the memory may also include non-volatile random access memory. For example, the memory may also store device type information.

A computer-readable storage medium is used for storing computer instructions, and when the computer instructions are executed by a processor, the method described in Embodiment 1 is completed.

The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software module may be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, no detailed description is given here.

Those skilled in the art can appreciate that the units of the examples described in this embodiment, that is, the algorithm steps, can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Although the specific implementation of the present invention has been described above in conjunction with the accompanying drawings, it does not limit the protection scope of the present invention. Those skilled in the art should understand that on the basis of the technical solution of the present invention, those skilled in the art do not need to pay creative work Various modifications or variations that can be made are still within the protection scope of the present invention.

Claims (8)

1. A traffic flow anomaly detection method based on pattern similarity, is characterized in that, comprises: Obtain traffic flow data; The improved long-short-term memory neural network is used to extract time-series features from traffic flow data; the improved long-short-term memory neural network obtains time-series features after weighted summation of hidden states obtained at different times; Segment the traffic flow data with a sliding window to obtain a short-term sequence set. After clustering the short-term sequence set, the short-term sequence corresponding to the cluster center of each category is used as the pattern feature; Calculate the temporal similarity of temporal features at different spatial locations; Determine the pattern feature with the closest distance to each pattern feature to form a pattern feature pair, and after weighting the nearest neighbor distance of the pattern feature pair, the pattern similarity at different spatial positions is obtained; The sequence similarity is determined according to the time series similarity and pattern similarity, and the dynamic relationship diagram of traffic flow at different times and different spatial locations is constructed according to the sequence similarity; Use the traffic flow dynamic relationship diagram and time series similarity to detect the abnormal state of traffic flow; In the process of weighting and summing the hidden states obtained at different times to obtain time series features, the weight is determined by the correlation between the hidden states at different times and the traffic flow data , with a weight of: Among them, xt ^is the traffic flow data on the tth day, for the hidden state, is the correlation function, is the parameter to be learned, is the number of days of the input traffic flow data, for the transpose operation; Calculating temporal similarity for temporal features at different spatial locations The process is: in, is the time series feature of spatial position a on the tth day, is the time series feature of spatial position b on the tth day, is the weight matrix to be learned And the network composed of the activation function tanh, Commander and to splice. 2. a kind of traffic flow anomaly detection method based on pattern similarity as claimed in claim 1, is characterized in that, in the process that the nearest neighbor distance of pattern feature pair is carried out weighting process, weight is the element that pattern feature place category comprises number. 3. A traffic flow anomaly detection method based on pattern similarity as claimed in claim 1, characterized in that the sequence similarity is determined by summing after the sequence similarity and the pattern similarity are weighted. 4. a kind of traffic flow anomaly detection method based on pattern similarity as claimed in claim 1, is characterized in that, the process of constructing traffic flow dynamic relationship diagram comprises: According to the sequence similarity of traffic flow data at different spatial locations, construct the relationship diagram of different spatial locations at the same time ; Introduce the connection relationship matrix between the traffic flow data in different spatial locations, and construct the dynamic relationship diagram of traffic flow according to the relationship diagram and the connection relationship matrix ; in, is the parameter to be learned, is the connectivity matrix, tanh is the activation function, and are the current moment and the moment indicated by the prior data, respectively, for the time difference, is a decreasing function. 5. a kind of traffic flow anomaly detection method based on pattern similarity as claimed in claim 4, is characterized in that, connectivity matrix is: Among them, X _a is the traffic flow data of spatial position a , X _b is the traffic flow data of spatial position b , is the connectivity matrix between X _a and X _b . 6. A traffic flow anomaly detection system based on pattern similarity, characterized in that, comprising: a data acquisition module configured to acquire traffic flow data; The timing feature extraction module is configured to use an improved long-short-term memory neural network to extract timing features from traffic flow data; the improved long-short-term memory neural network obtains timing features after weighted summation of hidden states obtained at different times; The pattern feature extraction module is configured to use a sliding window to segment the traffic flow data to obtain a short-term sequence set, and after clustering the short-term sequence set, use the short-term sequence corresponding to the cluster center of each category as the pattern feature; A timing similarity determining module configured to calculate timing similarity for timing features at different spatial locations; The pattern similarity determination module is configured to determine the pattern feature with the closest distance to each pattern feature to form a pattern feature pair, and after weighting the nearest neighbor distance of the pattern feature pair, the pattern similarity of different spatial positions is obtained; The dynamic relationship diagram building module is configured to determine the sequence similarity according to the time series similarity and the pattern similarity, and construct the dynamic relationship diagram of traffic flow at different times and different spatial locations according to the sequence similarity; The anomaly detection module is configured to detect the abnormal state of the traffic flow by using the traffic flow dynamic relationship diagram and the time series similarity; In the process of weighting and summing the hidden states obtained at different times to obtain time series features, the weight is determined by the correlation between the hidden states at different times and the traffic flow data , with a weight of: Among them, xt ^is the traffic flow data on the tth day, for the hidden state, is the correlation function, is the parameter to be learned, is the number of days of the input traffic flow data, for the transpose operation; Calculating temporal similarity for temporal features at different spatial locations The process is: in, is the time series feature of spatial position a on the tth day, is the time series feature of spatial position b on the tth day, is the weight matrix to be learned And the network composed of the activation function tanh, Commander and to splice. 7. An electronic device, characterized in that it comprises a memory, a processor, and computer instructions stored in the memory and run on the processor, when the computer instructions are run by the processor, any one of claims 1-5 can be accomplished the method described. 8. A computer-readable storage medium, characterized in that it is used to store computer instructions, and when the computer instructions are executed by a processor, the method according to any one of claims 1-5 is completed.

Images