WO2024205504A1 - Anomaly signal detection method and system - Google Patents

Abstract

The present application relates to an anomaly signal detection method, comprising: dividing a sensor signal into a plurality of sub-matrixes, wherein the plurality of sub-matrixes respectively correspond to sliding windows relative to the sensor signal on a time sequence; converting each sub-matrix into a corresponding k-nearest neighbor graph, wherein the k-nearest neighbor graph comprises a plurality of vertexes and a plurality of edges connected to the adjacent vertexes; trimming each k-nearest neighbor graph to remove edges having weights smaller than a weight threshold among the plurality of edges; splitting each k-nearest neighbor graph into a plurality of non-intersecting sub-graphs; obtaining the number of outlier variations corresponding to the number of outliers by comparing two continuous k-nearest neighbor graphs, wherein the outliers are respectively placed in different sub-graphs in the two continuous k-nearest neighbor graphs; and according to the number of outlier variations and a first threshold, determining whether there is an anomaly signal.

Description

根据一个实施例， 图 2至 4示出了一种异常信号检测的方法 300, Rj'ffl「检测异常的传感器信号 200, 例如多变量时间序列 T。 多变量时

多变量时间序列 T中的运行状态可以分为两种类型： 正常状态和 异常状态 (异常)。异常包括两部分： 异常传感器 (Abnormal Sensors) 和异常时间 ( Abnormal Time ) 。 异常传感器是指导致检测异常并且与 异常发生有根本关联的传感器，而异常时间则对应于传感器读数，通常 是指异常发生的时间段。 给定一个带有 n 个传感器的多变量时间序列 T, 异常检测的目标为找到 /个于矩阵 (从 T中) 为异常， 其中 /是异 常的数量。每个子矩阵代表一个异常 Z, 其中每一列表示单个异常时间 点；每行对应于导致异常的异常传感器的时间序列。子矩阵可以由 T 的 非相邻行组成， 也可由相邻列组成以保持异常时间连续。 多变量时间序列通常很长， 但异常往往在很短的时间序列内发生， 因此直接从多变量时间序列中检测异常具有难度。因此，异常信号检测 的方法 300包括在框 310,先将包括多变量时间序列的传感器信号划分 为多个子矩阵 210/220/230。子矩阵 210/220/230分别对应于在时间序列 上相对于传感器信号 200的各个滑动窗口 w。一些实施例中， 多个子矩 阵 210/220/230可 '重叠。给定滑动窗口 w之外，还包括步氐眼优选地， 步长 s小于滑动窗口 w。较大的滑动窗口 w及较小的步长 s有助于细粒 度跟踪相关性的变化。 然而， 较小的 s/w比例具有较多窗门， 因此较为 昂贵。 优选地， 设置 w e[0.01 | T|, 0.03幻]及 s e[0.01w, 0.02M小

个子矩阵 Ti具有相 RJ的长度 w。 值得注意的是， 当多变量时间序列不 能被滑动窗口 w整除时， 即 (|T|- w) 丰 O mod s, 从 s<w«|T|开始， 删除 T 的最后几序列以使其可整除。为了便于说明， 假设 R=(|T|- w)/s+l ,将 多变量时间序列 T转换为 R个重叠的子矩阵 {Ti, , TR} O 子矩阵 L Method and system for abnormal signal detection Technical field The present application relates to signal detection, and more particularly to a method and a system for abnormal signal detection. Background technology Sensor networks are widely used in industry, including monitoring the manufacturing process of assembly lines, recording the operating status of wind turbines, and other critical infrastructure. In these applications, an important function of sensor networks is to promote predictive maintenance by detecting anomalies in sensor-based multivariate time series as early as possible, which is crucial for timely detection and recovery of faults before serious damage occurs. It may be very challenging to achieve such detection goals. SUMMARY OF THE INVENTION In one aspect, the present application provides a method for abnormal signal detection. The method comprises: dividing the sensor signal including the multivariate time series into a plurality of sub-matrices, wherein the plurality of sub-matrices respectively correspond to respective sliding windows H relative to the sensor signal in the time series; converting each of the sub-matrices into a corresponding k-nearest neighbor graph, wherein each of the k-nearest neighbor graphs comprises a plurality of vertices and a plurality of edges connecting adjacent vertices; pruning each of the k-nearest neighbor graphs to remove the edges whose weights are less than a weight threshold among the plurality of edges; splitting each of the k-nearest neighbor graphs into a plurality of non-intersecting graphs; obtaining the number of outlier variation by comparing two consecutive k-nearest neighbor graphs, wherein the number of outlier variation corresponds to the number of outliers, and the outliers are respectively placed in different sub-graphs in the two consecutive k-nearest neighbor graphs; and determining whether the sensor signal has an abnormal signal according to the number of outlier variation and a first threshold. Preferably, the method further comprises, in response to the outlier variation being greater than or equal to the number of outliers, determining whether the sensor signal has an abnormal signal. J'' when the first threshold is exceeded, the sensor signal is determined to be abnormal. Preferably, the method further comprises obtaining the abnormal time and abnormal sensor corresponding to each of the at least one outlier according to at least one outlier. In one embodiment, the method further comprises obtaining the number of co-occurrences and the corresponding co-occurrence rate of each vertex by comparing two consecutive k-nearest neighbor graphs; and adding each vertex whose co-occurrence rate is lower than the second threshold to the outlier set. Preferably, the method further comprises obtaining the number of outlier mutations by comparing two consecutive outlier sets. Preferably, the method further comprises obtaining the average value and standard deviation of the number of outlier mutations according to historical sensor signals. Preferably, the method further comprises obtaining the first threshold according to the standard deviation of the number of outlier mutations. Preferably, the method further comprises determining whether the sensor signal has the abnormal signal according to the first threshold, the number of outlier mutations and the average value of the number of outlier mutations. Preferably, the method further comprises initializing the outlier set to an empty set. On the other hand, the present application provides a system capable of performing abnormal signal detection in real time. The system includes at least one sensor, wherein the at least one sensor can provide a sensor signal including a multivariate time series; and a computing device that forms a signal connection with the multiple sensors, wherein the computing device is configured to execute the method for abnormal signal detection described above. Description of the drawings FIG1 is a schematic diagram of a system that can perform abnormal signal detection in real time according to an embodiment of the present application; FIG2 is a schematic diagram of a multivariate time series according to an example of a sensor signal; FIG3 is a schematic diagram of a series of time series diagrams of the multivariate time series according to FIG2; FIG4 is a flow chart of a method for abnormal signal detection according to an embodiment of the present application; FIG5 is a schematic diagram of a method for abnormal signal detection according to another embodiment; FIG6 shows the difference between point adjustment and delay-point adjustment; FIG7 is an evaluation of the method for detecting abnormal signals according to FIG5 on SMD; FIG8 is a scalability test of the method for detecting abnormal signals according to FIG5 on data sets IS-1 to IS-5; and FIG9 is a time series of some sensors marked with abnormalities according to an example. Specific embodiments The present invention discloses a system for detecting abnormal signals, which can be used in real time to detect sensor signals, such as abnormal signals in a multivariate time series. As shown in FIG1, in one embodiment, the system 100 for detecting abnormal signals includes a plurality of sensors 110 and a computing device 120 connected to the plurality of sensors 110. The sensors 110 may include sensors with multiple uses, multiple setting positions, and multiple measurement properties. As an example, the plurality of sensors 110 may include multiple sensors in a robotic arm, such as a laser sensor, a sonar sensor, a temperature sensor, a pressure sensor, etc. The plurality of sensors 110 may provide signals to the computing device 120. The system 100 for abnormal signal detection that sends or provides a sensor signal 200 including a multivariate time series can implement an unsupervised abnormal signal detection method based on association analysis. The abnormal signal detection method is a deterministic method that can obtain stable output without model training. In addition, the method does not require pre-set assumptions about data distribution, and can therefore be easily extended to the processing of streaming data. The abnormal signal detection method identifies anomalies by observing the correlation between sensors or the correlation between sensor data, mining the changes in the correlation between the sensor/sensor data, and obtaining (1) the time period when the abnormality occurs (abnormal time) and (2) the affected components (abnormal sensors with abnormal readings) of the sensor signal. Combining these two aspects can provide valuable information for predictive maintenance. According to one embodiment, the method for detecting abnormal signals or the method for detecting abnormal signals identifies anomalies by observing the correlation between sensors and mining the changes in the correlation between sensor signals. To this end, the multivariate time series is first converted into a series of time series graphs (Time-Series Graph). In one embodiment, the time series graph is a k-nearest neighbor graph. Each vertex in the k-nearest neighbor graph corresponds to a sensor, and the edge between two vertices represents the correlation between the time series of two sensors over a period of time. The time series graph only connects sensors to highly correlated neighbors. In order to detect anomalies, a small number of affected vertices whose correlations with their neighbors have changed are first found; then, the abnormal correlation changes in the time series graph of these affected vertices are tracked. Finally, based on the theoretically guaranteed correlation change analysis, the method of abnormal signal detection can detect abnormal time periods and affected sensors. In addition, the method of abnormal signal detection is practical and reliable for early anomaly detection of noisy data. Once the time series changes abnormally at a specific time point, the correlation of the affected sensor with other sensors will change accordingly, and the edges related to these affected vertices on the time series graph will also change immediately. Therefore, once an anomaly occurs, a small anomaly in a sensor-based multivariate time series can be reflected by the affected vertices on the time series graph. However, since multivariate time series usually contain noise, reporting anomalies based on (a few) affected vertices may not be very accurate. Therefore, by tracking the relevant changes of a series of time series graphs, the vertices with significant changes are considered abnormal only when they are above the threshold. The method of abnormal signal detection can achieve rapid and reliable anomaly detection in noisy real-world data.

According to one embodiment, FIGS. 2 to 4 show a method 300 for detecting abnormal signals. Rj'ffl「Detect abnormal sensor signal 200, such as a multivariate time series T. Multivariate time

The operating state in the multivariate time series T can be divided into two types: normal state and abnormal state (abnormal). The abnormality includes two parts: abnormal sensors and abnormal time. Abnormal sensors refer to sensors that cause detection abnormalities and are fundamentally related to the occurrence of abnormalities, while abnormal time corresponds to sensor readings, usually referring to the time period when the abnormality occurs. Given a multivariate time series T with n sensors, the goal of abnormality detection is to find / sub-matrices (from T) that are abnormal, where / is the number of abnormalities. Each sub-matrix represents an abnormality Z, where each column represents a single abnormal time point; each row corresponds to the time series of the abnormal sensor that caused the abnormality. The sub-matrix can be composed of non-adjacent rows of T, or adjacent columns to keep the abnormal time continuous. Multivariate time series are usually long, but abnormalities often occur in a very short time series, so it is difficult to detect abnormalities directly from multivariate time series. Therefore, the method 300 for abnormal signal detection includes in box 310, first dividing the sensor signal including the multivariate time series into multiple sub-matrices 210/220/230. The sub-matrices 210/220/230 correspond to respective sliding windows w relative to the sensor signal 200 in the time series. In some embodiments, multiple sub-matrices 210/220/230 may overlap. In addition to the given sliding window w, the step size s is preferably smaller than the sliding window w. A larger sliding window w and a smaller step size s are helpful for fine-grained tracking of changes in correlation. However, a smaller s/w ratio has more windows and is therefore more expensive. Preferably, we[0.01|T|, 0.03W] and se[0.01W, 0.02W] are set to be smaller than 0.01W.

Each sub-matrix Ti has the same length w. It is worth noting that when the multivariate time series is not divisible by the sliding window w, that is, (|T|- w) mod s, starting from s<w«|T|, the last few sequences of T are deleted to make it divisible. For ease of explanation, assume R=(|T|- w)/s+l, and convert the multivariate time series T into R overlapping sub-matrices {Ti, , TR} O sub-matrices L

异常 Z由一对 (Vz, Rz)定义， 即， Z=(Vz, Rz), 其中 /zb为受异常影响 的所有顶点； Rz是异常发生时的一组连续轮次或连续的时间序列图。 异常信号检测的方法 300还包括在框 340中， 将每个所述 k-最近 邻图拆分为多个不相交的子图。 定义 1 说明了时间序列图中异常的总 体表示。 对于某一轮 r, 时间序列图 G可拆分为 ％个不相交的子图

松散连接， 则称 0.个子图为 4个社区 ( Community ) 。传感器网络通常 呈现社区结构。因此， 由传感器网络构建的时间序列图通常表现出社区 结构。有了社区结构， 可通过连续两轮或两个连续的时间序列图， 检测 不同顶点的相应社区中的变化， 以判断不同顶点的连通性是否稳定。基 于这种想法， 向 (Kz, Rz)添加了特定的约束， 得到定义 2 及定义 3。 定义 2 (受影响的顶点) ： 对时间序列图 G_r=(V, E_r)- , 给定轮 r£ (l, R］中具有 4社区， 顶点于集竹 J矿为受影响的顶点的于集。 受影响的 顶点为在连续两轮中移入或移出社区 Cr.c的每个顶点 vG " 即 14 ={v G V I (v Cr-i_:c and v £ C_r：_c) or (v £ C_r-i _c and v g G,_c)} o 根据定义 2, 如果 每个顶点 ve r在连续两轮中发生变化， 即移入或移出相应社区 Cg 将其表示为一个变化 (Variation ) 。 发生变化每个顶点 v可对应于一个 相应离群点。在框 350中， 通过对比两个连续的 k-最近邻图， 获得离群 点变异数量。在一个实施例中， 离群点变异数量町为在该序列中， 离群 点的总数或数量， 换言之， 可为顶点子集 K ■中受影响的顶点的数量。 可以理解地，两个连续的 k-最近邻图之间可能没有离群点， I大 I此所述离 群点变异数量则为零。当所述离群点变异数量不为零时，可包括至少一 个离群点。所述至少一个离群点在所述两个连续的 k-最近邻图中，可分 别置于不同的了图。因此，町获得包括其他轮次更多的变化的连续轮次， 并将这段时间视为异常时间。 定义 3 （异常时间及异常传感器） ： 给定第一阈值， 例如异常时间 阈值& （i W & Wn）及 R轮受影响的顶点｛Vi, ... , VR）, 异常时间 Rz 是

3中，如果存在较多受影响的顶点，则将轮尸视为异常。在一些情况下， 所有顶点都可能受到影响。 因此， 异常时间阈值 &的范围可以是 1W & Wn 。 因此， 在框 360中， 异常信号检测的方法 300还包括根据所述离 群点变异数量及第一阈值，例如异常时间阈值 判定传感器信号是否 只有 •异常信号，并在所述离群点变异数量大于或等于异常时间阈值 &时, 判定传感器信号为异常。 异常信号检测的方法 300 还包括可根据所述 至少一个离群点，获得相应于各个所述至少一个离群点的异常时间及异 常传感器。 设置异常时间阈值 &的相关内容在后续公开中说明。 如 图 2及 3示出了异常信号检测的方法 300的示例。 示例中展示 了带有 ”=4个传感器的多变量时间序列 T, 其中 |T|=8。 与 ti至 t6中的 传感器读数相比， S4t7及 S4t8中传感器读数显着下降。因此， 子矩阵（20 20）为异常 Z, 其中异常时间为 t7至 t8, 异常传感器为 s4。 其中， 滑动 窗口 w=4, 步长 s=2, 轮次 R=3, 权重阈值 T=0.8 _o 图 2示出了将多变量 时间序列 T转换为 R=3轮时间序列图｛Gj, G₂, G｝的示例。 给定一个子 矩阵 Tr, 当 彳丁或多行 （即传感器 S4 的口寸间序列） 发生异常变化时， 由于该传感器与其它传感器的相关性会发生相应变化，囚此时间序列图 Gr中与这些顶点相关的边， 即边 e=(S2, S4), 将立即改变。 因此， 以时间 序列图的形式， 可实现与使用多变量时间序列 形式相同的检测目标，

序列 T的一行， 彪为异常发生的时间段。 因此， 时间序列图中的异常 238 对应于多变量时间 200 序列中的异常子矩阵。 在多变量时间序列 200中， 异常传感器为 S4, 异常时间为 t7至 t8, 而在时间序列图 232中 为 KZ={S4)及人 z={r3}。 参考 图 5, 示出了异常信号检测的方法的一个实施例。 异常信号检 测的方法分为二个阶段： 在第一阶段 410, 将传感器信号划分并转换为 多个相应的时 '间序列图，例如 k-最近邻图。并根据顶点的相关性从不同 的时间序列图中检测不同的社区/子图。在第二阶段 420,在每两个连续 轮次或序列中挖掘每个顶点与其他顶点的共现关系，例如获得每个所述 顶点的共现数及相应的共现率， 并获得离群值。 在第二阶段 430, 定义 离群点变异数量并分析其属，件。异常检测过程的伪代码 1如下所示，可 返回离群值集及离群点变异数量。基于离群值变化数量的分析，异常信 号检测的方法可检测异常时间及异常传感器。 伪代码 1

(iWrWR) only displays the time series of each,'L individual sensor. In order to monitor the correlation between sensors and detect anomalies through abnormal correlation changes, each of the sub-matrices 210/220/230 is first converted into a corresponding time series graph (Time Series Graph). In box 320, each of the sub-matrices 210/220/230 time series graphs is converted into a corresponding k-nearest neighbor graph (k-Nearest Neighbor Graph) 212/222/232 _. As shown in Figure 3, each of the k-nearest neighbor graphs may include multiple vertices 214/224/234 and multiple edges 216/226/236 connecting adjacent vertices. For example, each matrix is converted into a corresponding k-nearest neighbor graph _Gr = (V, Er), where # is a set and each vertex corresponds to a sensor, that is, n=|F1; & is a set of edges. According to the Pearson correlation coefficient (Pearson Correlation), each vertex is connected to its k highest correlation neighbors. In addition, in each submatrix Tr, each is represented as a weighted graph, where the weight G(e), each edge e=(", v) EEr is the Pearson correlation coefficient of the time series of the two sensors «, v. When forming the k-nearest neighbor graph, setting a larger k value may include a weaker correlation with its k neighbors, resulting in additional noise and affecting the abnormality detection result. Conversely, setting a smaller left value may not include enough relevant information between sensors. Therefore, the corresponding left value can be set according to the sensor signal. In some embodiments, some vertices in the k-nearest neighbor graph G, still have weak correlation among k neighbors. These weakly correlated edges may change frequently in consecutive rounds or sequences, resulting in additional noise in the actual correlation between sensors. In order to accurately detect anomalies, preferably, in box 330, each of the k-nearest neighbor graphs is pruned to remove edges with weights less than a weight threshold T, that is, o ( _e )| < T _0. When there are a large number of sensors, the edge pruning is performed so that the method for abnormal signal detection only tracks the strong correlation between sensors. And perform real-time anomaly detection. In some embodiments, the weight threshold T affects the sparsity of the time series graph. A larger weight threshold T may cause some vertices in the time series graph to not have enough neighbors, and thus lack sufficient relevant information to detect anomalies. A smaller weight threshold T, This will cause the time series graph RJ to include many edges with weak correlation, resulting in additional noise. Preferably, a moderate weight threshold T is selected between 0.4 and 0.6. The pruned k-nearest neighbor graph for each submatrix T" can be called a time series graph G _ro |^|. Therefore, a longer multivariate time series T can be converted into a time series graph {G/, ..., GR} of R rounds. In the form of a time series graph, for example, the affected vertex 238 in FIG. 3 represents an abnormal sensor, and the continuous rounds of the abnormal sensor are used to represent the abnormal time. First, define the time series graph G ro |^|.

The anomaly Z is defined by a pair (Vz, Rz), that is, Z=(Vz, Rz), where Vzb is all vertices affected by the anomaly; Rz is a set of consecutive rounds or a consecutive time series graph when the anomaly occurs. The method 300 for detecting anomaly signals also includes, in block 340, splitting each of the k-nearest neighbor graphs into a plurality of non-intersecting subgraphs. Definition 1 illustrates the overall representation of anomalies in a time series graph. For a certain round r, the time series graph G can be split into % non-intersecting subgraphs

Loosely connected, the subgraphs are called 4 communities. Sensor networks usually present community structures. Therefore, time series graphs constructed by sensor networks usually show community structures. With the community structure, the changes in the corresponding communities of different vertices can be detected through two consecutive rounds or two consecutive time series graphs to determine whether the connectivity of different vertices is stable. Based on this idea, specific constraints are added to (Kz, Rz) to obtain Definition 2 and Definition 3. Definition 2 (affected vertices): For a time series graph G _r =(V, E _r )- , given a round r£ (l, R] with 4 communities, the vertex set J is the set of affected vertices. The affected vertices are each vertex vG " that moves into or out of the community Cr.c in two consecutive rounds, that is, 14 ={v GVI (v Cr-i _: c and v £ _Cr ： _c ) or (v £ Cr -i _{c and} vg G, _c )} o According to Definition 2, if each vertex ve r changes in two consecutive rounds, that is, moves into or out of the corresponding community Cg, it is represented as a variation. Each vertex v that changes may correspond to a corresponding outlier. In block 350, the outliers are obtained by comparing two consecutive k-nearest neighbor graphs. Point mutation number. In one embodiment, the outlier mutation number is the total number or number of outliers in the sequence, in other words, the number of affected vertices in the vertex subset K ■. It can be understood that there may be no outliers between two consecutive k-nearest neighbor graphs, so the outlier mutation number is zero. When the outlier mutation number is not zero, it may include at least one outlier. The at least one outlier may be placed in different graphs in the two consecutive k-nearest neighbor graphs. Therefore, a continuous round including more changes in other rounds is obtained, and this period is regarded as abnormal time. Definition 3 (Abnormal time and abnormal sensor): Given a first threshold, such as the abnormal time threshold & (i W & Wn) and R rounds of affected vertices {Vi, ..., VR), the abnormal time Rz is

3, if there are more affected vertices, the wheel corpse is regarded as abnormal. In some cases, all vertices may be affected. Therefore, the range of the abnormal time threshold & can be 1W & Wn. Therefore, in box 360, the method 300 for detecting abnormal signals also includes determining whether the sensor signal has only an abnormal signal based on the number of outlier mutations and the first threshold, such as the abnormal time threshold, and determining that the sensor signal is abnormal when the number of outlier mutations is greater than or equal to the abnormal time threshold &. The method 300 for detecting abnormal signals also includes obtaining the abnormal time and abnormal sensor corresponding to each of the at least one outlier based on the at least one outlier. The relevant content of setting the abnormal time threshold & is described in the subsequent disclosure. An example of the method 300 for detecting abnormal signals is shown in Figures 2 and 3. The example shows a multivariate time series T with t=4 sensors, where |T|=8. Compared with the sensor readings from ti to t6, the sensor readings in S4t7 and S4t8 drop significantly. Therefore, the submatrix (20 20) is the anomaly Z, where the abnormal time is t7 to t8, and the abnormal sensor is s4. Among them, the sliding window w=4, the step size s=2, the round R=3, and the weight threshold T=0.8 _oFigure 2 shows an example of converting the multivariate time series T into an R=3 round time series graph {Gj, _G2 , G}. Given a submatrix Tr, when one or more rows (i.e., the time series of sensor S4) undergo abnormal changes, the correlation between the sensor and other sensors will change accordingly, so the time series graph The edges in Gr associated with these vertices, i.e., the edge e=(S2, S4), will change immediately. Therefore, in the form of a time series graph, the same detection goal as using a multivariate time series form can be achieved,

A row of the sequence T is a time period when the anomaly occurs. Therefore, the anomaly 238 in the time series graph corresponds to the anomaly submatrix in the multivariate time series 200. In the multivariate time series 200, the abnormal sensor is S4, the abnormal time is t7 to t8, and in the time series graph 232, KZ={S4) and z={r3}. Referring to FIG5, an embodiment of the method for abnormal signal detection is shown. The method for abnormal signal detection is divided into two stages: In the first stage 410, the sensor signal is divided and converted into a plurality of corresponding time series graphs, such as k-nearest neighbor graphs. And different communities/subgraphs are detected from different time series graphs according to the correlation of the vertices. In the second stage 420, the co-occurrence relationship between each vertex and other vertices is mined in every two consecutive rounds or sequences, for example, the co-occurrence number and the corresponding co-occurrence rate of each vertex are obtained, and the outlier value is obtained. In the second stage 430, the number of outlier point variations is defined and its attributes are analyzed. The pseudo code 1 of the anomaly detection process is shown below, which can return the outlier set and the number of outlier point variations. Based on the analysis of the number of outlier changes, the abnormal signal detection method can detect abnormal time and abnormal sensors. Pseudo code 1

2 In G, Louvam should get wealth from the community;

3 _Or 0:

4 foreach e V do

定义 4 描述了两个顶点在连续两轮 /两个序列中的一次共现。 可通过计 算每个顶点与其他顶点的共现来监控每一轮中所有顶点所属的社区是 否产生变化或修改。 之后， 定义共现数 ( Co-appearance Number) 5r(v)8 return {O _r . n. _r }: The first stage 410 is community detection. The method of abnormal signal detection may include first The sensor signal is divided into multiple sub-matrices, and each of the sub-matrices is converted into a corresponding time series graph, such as a k-nearest neighbor graph. Different communities/sub-graphs are detected from different time series graphs according to the correlation of vertices. For each round r£ [l, R], the time series graph G ■ is first divided into communities using an algorithm such as Louvain, so that vertices that are more correlated than other vertices are divided into the same community (pseudocode 1, line 2). Through the community, the abnormal correlation changes of vertices can be tracked. Among the many community detection algorithms, it is preferred to select the Louvain algorithm, which is more effective and only requires O(n log〃) time. Figure 5 shows the first 10 rounds of time series graphs with 12 sensors. After the first stage, each time series graph is divided into three communities, but the communities in different rounds can be different. When an anomaly occurs, although the sensor may not initially show obvious abnormal behavior, the correlation of the sensor is likely to collapse, resulting in a change in the community. Next, the co-occurrence relationship of the vertices will be mined from the sensor's community. Phase 2: Co-occurrence mining. First, we define co-appearance. If two vertices are in the same community in two consecutive rounds/sequences, such as two rounds (r-1) and, they are called co-appearance or co-occurrence. Definition 4 (Co-occurrence): Given a round r W(l, with a vertex v; its previous community GTC and current community G., the calculation of co-occurrence Sr(v, _M ) is

Definition 4 describes the co-occurrence of two vertices in two consecutive rounds/sequences. By calculating the co-occurrence of each vertex with other vertices, we can monitor whether the community to which all vertices belong changes or modifies in each round. Then, we define the co-appearance number 5r(v)

在不同轮次中的共现数％ (v) 对每个顶点 v &K而言可能不同， 尤其是 存在异常时。 因此， 定义共现率（Ratio of Co-appearance Number） 以获 得通过某一个顶点的共现数， 基于目前为止的所有 r轮次的变化。 定 义 6 （共现率）： 对于每个 v &K, v在轮 r W（l,R］与其他顶点的共现率 计算如下： (According to vertex v) is the total number of vertices that co-occur with its corresponding vertex v. Definition 5 (Co-occurrence number): Co-occurrence number (v) is the number of vertices in each vertex v er (a round r W

The co-occurrence % (v) in different rounds may be different for each vertex v & K, especially When there are anomalies. Therefore, define the co-appearance ratio (Ratio of Co-appearance Number) to obtain the co-appearance number through a vertex, based on the changes in all r rounds so far. Definition 6 (Co-appearance ratio): For each v &K, the co-appearance ratio of v with other vertices in round r W(l,R] is calculated as follows:

如果一个顶点 V在,轮中始终与同一社区中的某一组顶点共现，则具有 较高 /大的 RC”并可被认为是正常的。 然而， 对于特定的一轮 r, 如果 顶点 v突然成为另一个社区的成员，其顶点 v则应被视为一个离群点或 离群值。 囚为这个社区可能只包含几个（或不包含）与顶点 v共现的其

例如离群值阈仇值进行 比较，以确定顶点 v是否是一轮 r中的离群点。

（1,R］ 中定义如下： o_r =（v er | Rc_v,_r<e} （4） 共现挖掘阶段的总体步骤描述如下。先将离群值集 Or初始化为空集（第

K, 计算各顶点 v的共现数 Sr（v）及共现率 RC_v,_r（伪代码 1第 5行） 。 并将共现率 RC”低于离样值阈值 0的各个顶点 v,添加入离样值集（伪 代码 1第 6行）。较高的离群值阈值。会排除许多应被视为离群值的顶 点， 从而导致检测精度低。优选地，对于大多数数据集， 将离群值阈值 0 设置为大约 0.3 o 值得注意的是， 由于多变量时间序列通常包含噪声， 因此（少数）离群值的存在在某些情况下，无法可靠地确定一轮为异常。 因此， 以下阶段说明了将分析离群值变化并减轻噪声的影响。 第 3 阶段： 变异分析。 时间序列图中的顶点在连续两轮 /序列中可' 具有二种状态： （1） 两轮都为正常状态、 （2） 两轮都为离群点 /离群 值、 （3） 正常状态与离群值之间的过渡。 例如， 如图 5, 顶点力及顶 点 c在第 9 轮及第 10轮中都为止常， 而顶点 a在第 9 轮中成为屋群 值， 并在笫 10轮中变为正常。 为了提高碰定异常 /异常时间的准确率及 可靠性，关注过渡状态并进一步定义离群点变异数量 ( Number of Outlier Variations) n_ro 定义 8 (离样点变异数量) ： 对于 -轮 r £(l,R], 离样点变异数量 n_r可定义为处于过渡状态的顶点数量， 即％ = &或 (("定 0_r-1 and v e 0_r) or (v E 0_r-1 and v t 0_r))_o根据定义 8, 通过对比两个连续轮次或序 列的离群值集， 例如分别为对应于轮次 r 1及轮次尸的离群值集 O_r-i

参考定义 3, 根据离群点变异数量及第 〃阈值， 例如异常时 '间阈值 & , 判定传感器信号是否具有异常信号 。 为一示例， 如果离群点变异数量

异 常检测。 给定一轮 r, 在获得离群点变异数量伍之后， 需确定当 前轮尸是否异常。在一个实施例中， 根据切比雪夫不等式 ( Chebyshevas Inequality) , 得出：

其中〃 为常数;〃及广分别为离群点变异数量伍的平均值及标准偏差。 为一个优选示例， 为了精确地检测异常， 默认设 ® /z = 3 o 因此， 异常 时间阈值 S为己 = 3c 即可根据离群点变异数最 m的标准偏差 c 获得

轮尸同为异常。 因此， 可根据异常时间阈值 4、 该轮尸的离群点变异数 量 0及离群点变异数量的平均值用 判定轮次,是否具有异常信号。 在一个 实施例中， 异常信号检测的方法中用于异常检测可通过以 下伪代码 2描述。使用 Z来存储异常， 并采用改及彪分别存储每个异 常或受影响的传感器及异常轮次 （伪代码 2第 2行） 。 在一个实施例 中， 对于每 ：轮 r E[\,R\， 先调用伪代码 1 中的方法进行离群值检测， 并获得离群值集 O’及离群点变异数量 n_r（伪代码 2第 6行） 。 使用 N 以存储一系列的离群点变异数量 n_ro值得注意的是，必及 b为确定异常 时间的两个参数。 如果 \n_r-M\ ^3a, 则判定该轮为异常， 因此将 r添加 到 Rz并将 Tz更新为 Or （伪代码 2第 8行） 。 如果々不为空， 意味着 当前异常结束，并将（氐死）添加到 Z并将改与彪重新初始化为空集（伪 代码 2第 11 行） 。 然后， 将 n添加到 N（伪代码 2第 12行） 并相应 地更新卜及 G（伪代码 2第 13行） ， 并返回所有检测到的异常 Z为输 出 （伪代码 2第 14行） 。 使用不等式 |〃厂川 A3b,对处理具有噪声的传感器信号 /数据较为可 靠。 基于某台机器的噪音通常处于同一水平， 使用皿 川可减低噪声的 影响， 并利用 3b区分实际异常与噪声数据。 在一些实施例中， 为了避 免可能因仅通过几个 m .所获得的#及 b的差异， 尤其是当 r 较少时，使 用历史多变量时间序列引入预热过程（伪代码 2第 16-23行）以获得足 够的 〃 ” 预热过程的输入来自 T相同的数据源的历史传感器信号， 例 如历史多变量时间序列 几”， 通过类似于异常检测的过程， 得到每一轮

确的离群点变异数量的平均值 M 及离群点变异数量的准偏差 c 进行 后续的异常检测。 伪代码 2 (3)

If a vertex V always co-occurs with a certain set of vertices in the same community in rounds, it has a high/large RC and can be considered normal. However, for a particular round r, if vertex v suddenly becomes a member of another community, then vertex v should be considered an outlier or outlier. This is because this community may contain only a few (or no) other vertices that co-occur with vertex v.

For example, the outlier threshold is compared with the value to determine whether the vertex v is an outlier in a round r.

（1,R］ is defined as follows: o _r =（ver | Rc _v , _r <e} （4） The overall steps of the co-occurrence mining phase are described as follows. First, the outlier set Or is initialized to an empty set (

K, calculate the number of co-occurrences Sr(v) and the co-occurrence rate RC _v , _r of each vertex v (pseudocode 1 line 5). And add each vertex v whose co-occurrence rate RC" is lower than the outlier threshold 0 to the outlier set (pseudocode 1 line 6). A higher outlier threshold will exclude many vertices that should be considered outliers, resulting in low detection accuracy. Preferably, for most data sets, the outlier threshold 0 is set to about 0.3. It is worth noting that since multivariate time series usually contain noise, the presence of (a few) outliers cannot reliably determine that a round is abnormal in some cases. Therefore, the following stage describes how to analyze outlier changes and mitigate the impact of noise. Stage 3: Variation analysis. The vertices in the time series graph can have two states in two consecutive rounds/sequences: (1) both rounds are normal, (2) both rounds are outliers/outliers, (3) the transition between normal state and outliers. For example, as shown in Figure 5, the vertex force and vertex Point c is constant in both the 9th and 10th rounds, while vertex a becomes a cluster value in the 9th round and becomes normal in the 10th round. In order to improve the accuracy and reliability of determining the anomaly/abnormal time, we pay attention to the transition state and further define the number of outlier variations (Number of Outlier Variations) n _r Definition 8 (Number of Outlier Variations): For a round r £(l,R], the number of outlier variations n _r can be defined as the number of vertices in the transition state, that is, % = & or (("定0 _r-1 and ve 0 _r ) or (v E 0 _r-1 and vt 0 _r )) _o According to Definition 8, by comparing the outlier sets of two consecutive rounds or sequences, for example, the outlier sets O _r -i corresponding to round r 1 and round p respectively

Referring to Definition 3, according to the number of outlier variation and the first threshold, such as the abnormal time threshold θ, it is determined whether the sensor signal has an abnormal signal. For example, if the number of outlier variation is

Anomaly detection. Given a round r, after obtaining the number of outlier mutations V, it is necessary to determine whether the current round is abnormal. In one embodiment, according to Chebyshevas Inequality, it is obtained that:

Wherein, 〃 is a constant; 〃 and 〃 are the average value and standard deviation of the number of outlier variation, respectively. As a preferred example, in order to accurately detect anomalies, it is assumed by default that ® /z = 3. Therefore, the abnormal time threshold S is 3c = 3c, which can be obtained according to the standard deviation c of the number of outlier variation m.

The wheel corpse is also abnormal. Therefore, according to the abnormal time threshold 4, the outlier variance of the wheel corpse The average value of the quantity 0 and the number of outlier mutations is used to determine whether the round has an abnormal signal. In one embodiment, the method for abnormal signal detection can be described by the following pseudo code 2 for abnormal detection. Z is used to store abnormalities, and each abnormal or affected sensor and abnormal round are stored separately using the modified and 標 (pseudo code 2 line 2). In one embodiment, for each round r E[\,R\, the method in pseudo code 1 is first called to perform outlier detection, and the outlier set O' and the number of outlier mutations n _r are obtained (pseudo code 2 line 6). N is used to store a series of outlier mutation numbers n _r. It is worth noting that the must and b are two parameters for determining the abnormal time. If \n _rM \ ^3a, the round is determined to be abnormal, so r is added to Rz and Tz is updated to Or (pseudo code 2 line 8). If 々 is not empty, it means that the current abnormality ends, and (氐死) is added to Z and modified and 標 are reinitialized to empty sets (pseudo code 2 line 11). Then, n is added to N (pseudocode 2 line 12) and 1 and G are updated accordingly (pseudocode 2 line 13), and all detected anomalies Z are returned as output (pseudocode 2 line 14). Using the inequality | 〃 factory 川 A3b, it is more reliable to process noisy sensor signals/data. Based on the fact that the noise of a certain machine is usually at the same level, the use of 皿川 can reduce the impact of noise, and use 3b to distinguish actual anomalies from noise data. In some embodiments, in order to avoid the difference in # and b that may be obtained by only a few m., especially when r is small, a warm-up process is introduced using a historical multivariate time series (pseudocode 2 lines 16-23) to obtain enough 〃 ". The input of the warm-up process comes from the historical sensor signal of the same data source as T, such as the historical multivariate time series several ". Through a process similar to anomaly detection, each round is obtained.

The mean value M of the number of outlier mutations and the accurate deviation c of the number of outlier mutations are used for subsequent anomaly detection. Pseudocode 2

Input: MTS T. Historical MTS T _hzs , sliding window step size and outlier threshold

% N, call and # WarrYiUp(T^ _ST w, &);

2 Z ^-^ Vz ^-^ Rz ^r- 0; OQ — 0;

3 R = (|T| one place)chuan + L

文本 公开的异常信号检测的方法可检测基于传感器的多变量时间 序列的异常。值得注意的是，所述异常信号检测的方法可扩展至处理流 数据。例如， 当新一轮数据亦 +i到达时， 可通过本异常信号检测的方法 实现实时检测异常。由于对每一轮执行异常信号的检测，检测过程可与 新数据收集同时进行。只要异常信号检测的方法每一轮的运行时间小于 一步 s的时间段， 则可实时检测异常。 此外， 在异常检测过程中， 通过 维护一系列伍， 可获得口及眼 在实时检测的条件下， 伍的数量随着越 来越多的数据流进入而增加， 可更精确地估计〃及。的值，从而实现更 准确地检测异常。 因此， 实时检测可应用「各种工业场景， 例如服务器 节点、 商业服务器、 供水网络、 电力传感器、 工业流水线等。 此外， 本 异常信号检测的方法可在较早期发现异常。 主要原 I大 I为当异常发生时， 虽然传感器可能不会表现出明显的异常行为，但受影响的传感器之间的 相 关性很可能会发生变化， 因此可通过本方法捕捉到这种变化。 时间序列异常检测的评估通常基于点调整 ( Point Adjustment,简称 PA) 。 参考图 6, 给定时间序列的异常标签， 一旦在该范围内中检测到 单个时间点， 则认为检测到该异常。之后， 直接与标签值进行比较以计 算尸 1 的值。 由于点调整 PA不考虑首先检测到异常的时间点， 囚此忽 略了检测到异常时的时间顺序，并且不评估检测到的时间先后。为了解 决点调整 PA 中的问题， 本文提供了一种新的评估方案为延迟点调整 ( Delay-Point Adjustment, 简称 DPA)以反映检测到异常时的时间顺序。 与点调整 PA 相比， 基于每个异常， 延迟点调整 DPA仅调整第一个真 阳性 ( True Positive ) 之后的假阴性 (False Negative ) 。 图 6中， 基于 相 同的异常检测方法 Mi, 通过使用延迟点调整 DPA, 使得仪 /s及 4中 的两个假阴性被调整为真阳性， 而 77至冷中的二个假阴性保持不变。 因此，尸比处=72.7%。与点调整 PA相比， 延迟点调整 DPA 为较严格的 评 估， 即 F'DPA WF'PA。 此外， 提出了两个相对评估的方法： 早于 ( Ahead) 及未检测到 (Miss) , 用于两种方法的检测结果之间的相对比较。

常检测方法 Mi早于 (Ahead) 异常检测方法 "检测到的异常敬目， 而 lm,_ss 为异常检测方法庭 1未检测到 (Miss) 但异常检测方法庭 2检测出

有遗漏任何异常。 因此， Ahead^50%, Miss=Q。 在理想情况下， Ahead = 100% , Miss = 0。 通过实验， 评估本异常信号检测的方法 （简称 CAD） 相对于其他 方法 的表现。其中对每个时间序列执行这些方法，并将异常分数的平均 值作为输 出。 其他方法包括三种基于数据挖掘的方法： LOF、 ECOD及 TForest； 两个深度学习方法： USAD 及 RCoders； 及四种 变量方法： S2G、 SAND、其在线版本 SAND*及 NormA。使用了均带有标签信息的 传感器数据集： PSM、 SWaT及 SMD, 以及来自工业的两个私有数据集 IS-1及 IS-2o SMD数据集由 28个不同的子集组成， 没有进行预热过程 直接对每个子集进行方法评估。 表 II总结了八个数据集的统计数据。 表 III示出了在 PSM、 SWaT、 IS-1 及 IS-2 的传感器数据集上的 异常时 间检测结果，其中标准差（S0）是根据重复 10次的刊 R4及 F1_DPA 获得 。 由于本申请的方法 CAD、 LOF、 ECOD及 S2G的结果不会随着 不 同的重复而改变，因此相应的标准差为 0。如表 III所示，本方法 CAD 优于 IS-1 的所有基线， 并达到了 FM及 FIDPA的最高平均排名。表 IV 示 出了 SMD数据集的结果。 本方法 CAD在 28个子集中至少有 17 个 优于 USAD、 RCoders、 S2G、 SAND、 SAND*及 NormA 的其他方法， 并且与 LOF、 ECOD 及 IForest方法相当。 表 II 八个传感器数据集的统计数据

4 for r = 1 to 7?. do

The method for detecting abnormal signals disclosed in the text can detect abnormalities in multivariate time series based on sensors. It is worth noting that the method for detecting abnormal signals can be extended to process streaming data. For example, when a new round of data also arrives, the method for detecting abnormal signals can be used to detect abnormalities in real time. Since the detection of abnormal signals is performed for each round, the detection process can be carried out simultaneously with the collection of new data. As long as the running time of each round of the method for detecting abnormal signals is less than a time period of one step s, the abnormality can be detected in real time. In addition, in the process of abnormality detection, by maintaining a series of fives, the mouth and eyes can be obtained. Under the condition of real-time detection, the number of fives increases as more and more data streams enter, and the value of can be estimated more accurately, thereby achieving more Accurately detect anomalies. Therefore, real-time detection can be applied to various industrial scenarios, such as server nodes, commercial servers, water supply networks, power sensors, industrial assembly lines, etc. In addition, the method of abnormal signal detection can detect anomalies at an earlier stage. The main reason is that when an anomaly occurs, although the sensor may not show obvious abnormal behavior, the correlation between the affected sensors is likely to change, so this change can be captured by this method. The evaluation of time series anomaly detection is usually based on point adjustment (PA). Referring to Figure 6, given the anomaly label of a time series, once a single time point is detected within the range, the anomaly is considered to be detected. After that, it is directly compared with the label value to calculate the value of . Since the point adjustment PA does not consider the time point when the anomaly is first detected, the time order when the anomaly is detected is ignored, and the time order of detection is not evaluated. In order to solve the problem in the point adjustment PA, this paper provides a new evaluation scheme for delay point adjustment (DPA) to reflect the time order when the anomaly is detected. Compared with the point adjustment PA, based on each anomaly, the delay point adjustment DPA only adjusts the first true positive ( In FIG6 , based on the same anomaly detection method Mi, by using the delayed point adjustment DPA, the two false negatives in the instrument/s and 4 are adjusted to true positives, while the two false negatives in 77 to cold remain unchanged. Therefore, the ratio of corpse to place = 72.7%. Compared with the point adjustment PA, the delayed point adjustment DPA is a stricter evaluation, namely F'DPA WF'PA. In addition, two relative evaluation methods are proposed: Ahead and Miss, which are used for relative comparison between the detection results of the two methods.

The abnormal detection method Mi is detected earlier than the abnormal detection method "(Ahead), while lm, _ss is the abnormal detection method 1 that did not detect (Miss) but the abnormal detection method 2 detected

There is no missing exception. Therefore, Ahead^50%, Miss=Q. In an ideal case, Ahead = 100%, Miss = 0. Through experiments, the performance of the proposed method for abnormal signal detection (CAD) is evaluated relative to other methods. These methods are executed for each time series and the average of the anomaly scores is taken as the output. Other methods include three data mining-based methods: LOF, ECOD and TForest; two deep learning methods: USAD and RCoders; and four variable methods: S2G, SAND, its online version SAND* and NormA. Sensor datasets with label information are used: PSM, SWaT and SMD, as well as two private datasets from industry, IS-1 and IS-2o. The SMD dataset consists of 28 different subsets, and the method evaluation is performed directly on each subset without preheating. Table II summarizes the statistics of the eight datasets. Table III shows the results of abnormal time detection on the sensor datasets of PSM, SWaT, IS-1 and IS-2, where the standard deviation (S0) is obtained based on the publication R4 and F1 _DPA repeated 10 times. Since the results of the proposed method CAD, LOF, ECOD and S2G do not change with different repetitions, the corresponding standard deviation is 0. As shown in Table III, the proposed method CAD outperforms all baselines of IS-1 and achieves the highest average ranking of FM and FIDPA. Table IV shows the results of the SMD dataset. The proposed method CAD outperforms the other methods of USAD, RCoders, S2G, SAND, SAND* and NormA in at least 17 of the 28 subsets, and is comparable to the LOF, ECOD and IForest methods. Table II Statistics of the eight sensor datasets

CAD 95*0 89.7 83.8 78.2

LOF 76,2 7: L4 80.1 74.1

ECOD 87.1 80.5 84.0 77.6

IForest 91,4± 0.9 85.7 ± 1.7 84.9 ± 0.5 76.9 ± 0.4

USAD E ± (17 76J?> ± 1 80.3 i 0.3 7：L5 ± 2.4

RCocte 94.2 ± 1.1 90.6 ± 1.2 81.9 ± 1.0 76.3 ± 1.2

S2G 93.6 85.0 84.9 Hua, U

SAND 85.7±0.6 73.5 ± 2.4 80.5 ± 4.2 60. G ± 3.2

SAND" -®.O i L6 72.8 ± 1.3 8(). D ± 0.0 77.8 ± 0.8

NormA 85.7 i (12 76.7 ± 0.6 80.4 ± 0.6 75.2 ± 1.3 , , average

CAD lOD.O 97.4 98.2 91.1 1>6

LOF 100.0 83.8 99.9 70.3 6.1

ECOD 99.9 <)7.3 71.1 64.0 4.3 iForest 99.1 ± 1.3 94.4 ± 2.4 71.3 i 22 67.3 ± 1.9 3.9

USAD 99.8± 0.0 84.0± 0.0 82.6 i (L0 60.2 ± 0.0 6.3

RCoders 99.4 i 0.8 89.8 ± 4.9 64.6 i 2.3 62.4 ± 1.9 4.6

S2G 95.3 85.9 72;7 67.9:18

SAND 78.6 ± 4.3 67.2 i 2.3 68.7 ± 2/7 50.5 ± 0.7 8.6

SAND* 93.2 i 2.() 87.5 ± 2.6 6L5 ± 1.2 5U ± 1,0 7.6

NormA 95.3 ± 1.5 82.2 ± 11 55,5 ± Ch3 52.3 ± 0,1 7:8 Table IV Abnormal time and abnormal sensor detection on SMD

(OP is the number of subsets that CAD can outperform in the 28 subsets)

CAD 80.7 ^ 14.4 71.7 ^ 15.9

LOF 16 75.0± 24.4 13 65.5± 26.0 /

ECOD 14 83.0 ± 14.5 12 73.2 ± 16.8 28

1 Forest 7 86.5 ± 13.7 8 76.5Tu 18.4 /

USAD 20 75.3 ± 18.4 17 6 (15 ± 20.7 /

R Coders 21 75.3± 17.4 19 63.6± 20.2 28

S2G 25 64.0 ± 21.4 23 52.5 ± 21.4 /

SAND 26 45,3 ± 30.3 26 33.5 ± 25.7 /

SAND" 26 51.1 ± 28.8 24 38.7 ± 25.8 /

NormA 25 55.3 ± 29.3 26 42.6 ± 26.5 / When the number of sensors tl increases, for example from IS-1 to IS-2, the results of some methods (such as LOF and USAD) drop significantly when adjusting DPA at the delay point. This is partly due to the multivariate time series with more sensors. The performance of the four univariate methods is significantly reduced under point-adjusted PA and delayed point-adjusted DPA. This shows that it is not easy to extend these methods to multivariate time domains. The sequence may be invalid. Since most benchmark methods detect outliers based on certain assumptions, they may become unstable and more sensitive to noise. In contrast, the CAD method detects outliers based on a series of time series plots. The abnormal changes can reduce the noise and be more stable. Table V shows the evaluation of Ahead and Miss. The method CAD described in this application is compared with other methods. At least 50% (PSM and SWaT sensor datasets), while its miss rate is still less than 50% (except SAND). The results show that for the detected anomalies, our anomaly signal precedes other discoveries at least half; for those anomalies missed by CAD, others can detect at most half. Refer to Figure 7, for all 28 subsets of the SMD dataset, The CAD method is superior to other methods. Compared with other methods, the CAD method can achieve Ahead>50°/ _o in most subsets of SMD, and more than half of the subsets have Miss<50%, thus verifying the CAD method. The method can detect abnormal time as early as possible and almost no omissions. Table V Evaluation of Ahead and Miss

_CAD w PSM SWaT IS-1 IS-2 Other methods Ah Ms Ah Ms Ah .Ms Ah Ms

LOF 60.0 40.4 100.0 0.D 106.0 OX) 77.8 CLO

ECOD 73.3 19.3 100.0^ 35.3 100 0 0.0 66.7 0.0

1 Forest 50.0 40.4 100. Q 37.9 10G.0 D.O 36/7 0.0

USAD 66.4 17,5 100.0 9.7 100.0 0.0 77.8 0.0

RCoders 64/7 31.8 100.0 13.5 100.0 0.0 43.3 0.0

S2G 73.3 12.3 100.0 31.2 10Q.0 0.0 100,0 0.Q

SAND 96.0 8.2 100.Q 59.1 1QG.0 100.0 0X)

SAND^ 86.7 12.8 100.0 4.7 1OD.0 0.0 100.0 0.0

NormA 82.0 19.5 100. Q 15.7 WO.O DO 100.0 0.0 The CAD method can not only detect abnormal time, but also reveal abnormal sensors. The last column of Table IV shows the abnormal sensor detection results on SMD. It is observed that the CAD method The CAD method outperforms the ECO D and RCoders methods by a ratio of 28/28, which are the only two benchmark methods for obtaining abnormal sensors. Based on the sensor data sets IS-1 and IS-2, the CAD method of this method is also better than the ECO D and RCoders methods, and its F\ _sensor exceeds 60%. Therefore, at least half of the normal sensors can be excluded, which greatly reduces the pressure on operators to perform predictive maintenance. Table VI shows the detection time of the CAD method in each round, that is, the time per round (TPR for short). In order to detect abnormalities in real time, the time per round TPR should be less than the time corresponding to the step size s, that is, TPR < s, where s is the sampling frequency of the sensor. Therefore, "eg Vs/TPR Hz. According to the results listed in Table VI, the CAD method can support real-time anomaly detection, that is, the maximum frequency supported by the method on SWaT and IS-2 is approximately 43 kHz and 331 Hz, respectively, which is much larger than the corresponding actual sampling frequency of 1 Hz and 1/900 Hz.

IFarest 1.5 11.3 0.5 4.3

USAD 0.6 3.1 0.2 OS 0.2

RCoders 1 11,0 111 47,0 (K6

S2G 6,4 34,3 D,9 2,8 1.9

SAND 12.7 20,3 3.8 5,0 4.6

SAND* 7.9 21.7 1.7 Night 2 3.2

NorniA 8.6 105.5 1.3 4,6 3.2 Referring to Figure 8, the proposed CAD method is run on a large real-world labeled dataset (i.e., IS-1-IS-5) for anomaly detection by increasing the number of sensors. The left side of Figure 8 shows the results of anomaly detection in real time. Even though the IS-5 dataset contains more than one thousand sensors, the proposed method can still ensure anomaly detection accuracy of Fl DPA > 85%. The right side of Figure 8 shows the TPR of each round of anomaly detection on IS-1 to IS-5, which shows that the proposed CAD method is scalable to a large number of sensors, and real-time anomaly detection can be achieved as long as the TPR of each round is less than one step time (as in the case of IS-1-IS-5). FIG9 shows the time series of some sensors of the subset SMD 1_6 in the SMD, which covers the abnormal time period of the second abnormality, indicating the sensors affected by the abnormality. When the abnormality occurs, the time series of the abnormal sensors (e.g., sensors 2-4, 9, 12, and 13) are (very) different from the previous sensors, while the normal sensors (e.g., sensors 19-21) still maintain the original trend and are not affected by the abnormality. Sensors 2 to 4 initially behave like sensors 9, 12, and 13, and therefore have a strong correlation. When the abnormality occurs, some time series will change, and sensors 2 to 4 will no longer be associated with sensors 9, 12, and 13. Since the present method CAD uses the edges in the time series graph to represent the strong correlation between sensors, the abnormal changes of some sensors can be immediately reflected by the changes in the edges. Therefore, they can be reported as abnormal sensors earlier and accurately. However, when such an abnormality occurs in the initial stage, the changes in the time series may be negligible, so other methods based only on specific rules may not be able to detect it early. In addition, the first row of FIG. 9 shows the time point at which each method detects this anomaly. It can be seen that when an anomaly occurs, the present method can detect the anomaly immediately, so it is suitable for the industrial environment of the real world, and can avoid the propagation of faulty components to other adjacent components over time due to untimely maintenance. As used herein, unless otherwise explicitly stated, the singular "one" and "an" may be interpreted as including the plural "one or more". The present disclosure is presented above for the purpose of illustration and description, but is not intended to be exhaustive or limiting. Many modifications and variations are obvious to those of ordinary skill in the art. The example embodiments are selected and described in order to explain the principles and practical applications, and to enable those of ordinary skill in the art to understand the various embodiments of the present disclosure, which have various modifications suitable for the intended specific purposes. Therefore, although the illustrative example embodiments are described herein with reference to the accompanying drawings, it should be understood that the description is not restrictive, and that those skilled in the art may implement various other changes and modifications therein without departing from the scope, innovative concepts and technical solutions of the present disclosure.

Claims

Claims 1. A method for detecting abnormal signals, characterized in that the method comprises: dividing a sensor signal including a multivariate time series into a plurality of sub-matrices, wherein the plurality of sub-matrices respectively correspond to respective sliding windows relative to the sensor signal in the time series; converting each of the sub-matrices into a corresponding k-nearest neighbor graph, wherein each of the k-nearest neighbor graphs comprises a plurality of vertices and a plurality of edges connecting adjacent vertices; pruning each of the k-nearest neighbor graphs to remove edges whose weights are less than a weight threshold among the plurality of edges; splitting each of the k-nearest neighbor graphs into a plurality of non-intersecting graphs; obtaining an outlier variation number by comparing two consecutive k-nearest neighbor graphs, wherein the outlier variation number corresponds to the number of outliers, and the outliers are respectively placed in different sub-graphs in the two consecutive k-nearest neighbor graphs; and determining whether the sensor signal has an abnormal signal according to the outlier variation number and a first threshold. 2. The method according to claim 1, characterized in that, in step D, the method further comprises determining that the sensor signal is abnormal in response to when the number of outlier point variations is greater than or equal to the first threshold. 3. The method according to claim 2, characterized in that the method further comprises obtaining, based on at least one outlier, an abnormal time and an abnormal sensor corresponding to each of the at least one outlier. 4. The method according to claim 1, further comprising: obtaining the number of co-occurrences and the corresponding co-occurrence rate of each vertex by comparing two consecutive k-nearest neighbor graphs; and adding each vertex whose co-occurrence rate is lower than a second threshold into an outlier. Set. 5. The method according to claim 4 is characterized in that the method further comprises obtaining the number of outlier point variations by comparing two consecutive outlier value sets. 6. The method according to claim 5 is characterized in that the method also includes obtaining the average value and standard deviation of the outlier point variation quantity based on historical sensor signals. 7. The method according to claim 6 is characterized in that the method further comprises obtaining the first threshold value according to a standard deviation of the number of outlier point variations. 8. The method according to claim 7 is characterized in that the method further comprises determining whether the sensor signal has the abnormal signal based on the first threshold, the number of outlier variations and the average value of the number of outlier variations. 9. The method according to claim 4, characterized in that the method further comprises initializing the outlier set to an empty set. 10. A system capable of performing abnormal signal detection in real time, characterized in that the system comprises: at least one sensor, wherein the at least one sensor can provide a sensor signal including a multivariate time series; and a computing device that forms a signal connection with a plurality of sensors, wherein the computing device is configured to execute the methods of claims 1 to 9.