CN111241158A - Anomaly detection method and device for aircraft telemetry data - Google Patents

Abstract

The invention provides an anomaly detection method and device for aircraft telemetering data, which relate to the technical field of data processing and comprise the steps of obtaining pilot telemetering data sent by an aircraft, and determining whether the pilot telemetering data is a stable time sequence or not through stationarity detection; after stationarity detection is finished, acquiring telemetering data of a node at the current time, which is sent by an aircraft; if the pilot telemetering data is a stable time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data; if the pilot telemetering data is not the stationary time sequence, detecting the telemetering data of the node at the current moment by using a preset detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data, so that the technical problems that the detection step for detecting the abnormal data of the telemetering data is complex and the detection accuracy is low in the prior art are solved.

Description

Anomaly detection method and device for aircraft telemetry data

technical field

The present invention relates to the technical field of data processing, in particular to a method and device for detecting abnormality of telemetry data of an aircraft.

Background technique

For satellite telemetry, the rapid transient changes in the space environment and equipment line noise will cause noise interference to signal acquisition, so that the telemetry data is mixed with randomly distributed abnormal data. development has brought great difficulties.

In the prior art, algorithms such as boundary detection algorithm, trend prediction algorithm, rate constraint algorithm, density (distance) detection algorithm, etc. are generally used to detect abnormality of telemetry data, but the above-mentioned methods have complicated detection steps and low detection accuracy.

For the above problems, no effective solutions have been proposed yet.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present invention is to provide an abnormality detection method and device for aircraft telemetry data, so as to alleviate the complicated detection steps and low detection accuracy in the prior art for abnormal data detection of telemetry data. question.

In a first aspect, an embodiment of the present invention provides an abnormality detection method for aircraft telemetry data, including: acquiring pilot telemetry data sent by an aircraft, and determining whether the pilot telemetry data is a stationary time series through stationarity detection; After performance detection, obtain the telemetry data of the node at the current moment sent by the aircraft; if the pilot telemetry data is a stationary time series, use the boundary detection algorithm to detect the telemetry data of the node at the current moment, and determine the telemetry data of the node at the current moment Whether it is abnormal data; if the pilot telemetry data is not a stationary time series, a preset detection algorithm is used to detect the telemetry data of the node at the current moment to determine whether the telemetry data of the node at the current moment is abnormal data, wherein, The preset detection algorithm includes at least one of the following: a three-point set isomorphic map detection algorithm, and a left and right dual coset weighted map detection algorithm.

Further, the method further includes: cleaning the abnormal data.

Further, cleaning the abnormal data includes: determining first target data and second target data, wherein the first target data is the first normal telemetry data before the node at the current moment, and the The second target data is the first normal telemetry data after the node at the current moment; the average value of the first target data and the second target data is calculated, and the abnormal data is replaced with the average value.

Further, using a preset detection algorithm to detect the telemetry data of the node at the current moment, and determining whether the telemetry data of the node at the current moment is abnormal data, includes: determining the performance type of the aircraft, wherein the performance type Including: a first performance type and a second performance type, the on-orbit processing capability of the aircraft of the first performance type is lower than the on-orbit processing capability of the aircraft of the second performance type; based on the performance type, determine the The target detection algorithm in the preset detection algorithm is used; the target detection algorithm is used to detect the telemetry data of the node at the current moment, and determine whether the telemetry data of the node at the current moment is abnormal data.

Further, determining the target detection algorithm in the preset detection algorithm based on the performance type, including: if the performance type of the aircraft is the first performance type, the target detection algorithm is the three-point set isomorphic mapping detection algorithm; if the performance type of the aircraft is the second performance type, the target detection algorithm is the left and right dual coset weighted mapping detection algorithm.

Further, if the target detection algorithm is the three-point set isomorphic mapping detection algorithm; use the target detection algorithm to detect the telemetry data of the node at the current moment to determine whether the telemetry data of the node at the current moment is not. is abnormal data, including: determining the neighbor nodes of the node at the current moment, wherein the neighbor nodes include: a first neighbor node and a second neighbor node, and the first neighbor node is the neighbor before the node at the current moment node, the second neighbor node is the neighbor node after the current moment node; use the current moment node and the first neighbor node to construct a first vector line segment, and use the current moment node to construct the second The second vector line segment constructed by the neighbor node, and determine the angle of the vector angle formed by the first vector line segment and the second vector line segment; if the angle is less than the preset threshold, the telemetry of the node at the current moment The data is abnormal data.

Further, if the target detection algorithm is the left and right bi-coset weighted mapping detection algorithm; using the target detection algorithm to detect the telemetry data to determine abnormal data in the telemetry data, including: Construct the k-ary double coset of the node at the current moment; calculate the distance threshold of the k-ary double coset, and assign values to the nodes in the k-ary double coset, and obtain the node assignment; determine the current moment of the node. Tightness factor comparison threshold; Combining the distance threshold of the k-ary double coset and the node assignment, calculate the tightness of the node at the current moment;

If the closeness is less than the closeness factor comparison threshold, the telemetry data of the node at the current moment is abnormal data.

Further, using a boundary detection algorithm to detect the telemetry data of the node at the current moment, and determining whether the telemetry data of the node at the current moment is abnormal data, includes: determining whether the telemetry parameter of the telemetry data of the node at the current moment is in a preset boundary If not, the telemetry data of the node at the current moment is abnormal data.

In a second aspect, an embodiment of the present invention further provides an abnormality detection device for aircraft telemetry data, including: a first acquisition unit, a second acquisition unit, a first detection unit, and a second detection unit, wherein the first acquisition unit The unit is used to acquire the pilot telemetry data sent by the aircraft, and determine whether the pilot telemetry data is a stationary time series through stationarity detection; the second acquisition unit is used to acquire the current moment node sent by the aircraft after the stationarity detection is completed The first detection unit is used to detect the telemetry data of the node at the current moment by using the boundary detection algorithm when the pilot telemetry data is a stationary time series, and determine whether the telemetry data of the node at the current moment is not. is abnormal data; the second detection unit is configured to use a preset detection algorithm to detect the telemetry data of the node at the current moment when the pilot telemetry data is not a stationary time series, and determine the node at the current moment Whether the telemetry data is abnormal data, the preset detection algorithm includes at least one of the following: a three-point set isomorphic mapping detection algorithm, and a left and right dual coset weighted mapping detection algorithm.

In a third aspect, an embodiment of the present application further provides a computer-readable medium having a non-volatile program code executable by a processor, the program code causing the processor to execute the aircraft telemetry data described in the first aspect anomaly detection method.

In the embodiment of the present invention, first, the pilot telemetry data sent by the aircraft is obtained, and the stationarity detection is used to determine whether the pilot telemetry data is a stationary time series; then, after the stationarity detection is completed, the telemetry of the node at the current moment sent by the aircraft is obtained If the pilot telemetry data is a stationary time series, the boundary detection algorithm is used to detect the telemetry data of the node at the current moment to determine whether the telemetry data of the node at the current moment is abnormal data; if the pilot telemetry data is not a stationary time series, the prediction Suppose the detection algorithm detects the telemetry data of the node at the current moment, and determines whether the telemetry data of the node at the current moment is abnormal data, wherein the preset detection algorithm includes at least one of the following: a three-point set isomorphic mapping detection algorithm, left and right double cosets Weighted map detection algorithm.

In the embodiment of the present invention, by performing stationarity detection on the pilot telemetry data, it is determined whether the pilot telemetry data is a stationary time series, and different detection algorithms are selected according to the detection results to detect the telemetry data of the node at the current moment, so as to determine whether the pilot telemetry data is a stationary time series. Whether the telemetry data of the node at the current moment is abnormal data, the purpose of abnormality detection of telemetry data is achieved, and the technology of abnormal data detection of telemetry data in the prior art is solved with complicated detection steps and low detection accuracy. Therefore, the detection steps of abnormal data detection of telemetry data are simplified, and the technical effect of improving detection accuracy is realized.

Other features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the description, claims and drawings.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to illustrate the specific embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the specific embodiments or the prior art. Obviously, the accompanying drawings in the following description The drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

1 is a flowchart of a method for detecting anomalies in aircraft telemetry data according to an embodiment of the present invention;

FIG. 2 is a flowchart of another abnormal detection method for aircraft telemetry data provided by an embodiment of the present invention;

3 is a flowchart of detecting abnormal data by using a three-point set isomorphic mapping detection algorithm according to an embodiment of the present invention;

4 is a flowchart of detecting abnormal data by utilizing the left and right dual coset weighted mapping detection algorithm provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of an abnormality detection apparatus for aircraft telemetry data according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. example. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The current anomaly detection methods include boundary detection algorithm, trend prediction algorithm, rate constraint algorithm, density (distance) detection algorithm and other algorithms, among which:

1) Boundary detection algorithm: Boundary detection algorithm is the most widely used anomaly detection method in satellite missions. Usually, the aircraft controller provides the normal boundaries of each telemetry parameter based on the samples obtained during the ground test phase and the experience of previous satellite missions. If the data exceeds the upper and lower bounds, it is considered to be abnormal data;

2) Trend prediction algorithm: Since the time series usually has a certain trend, the trend prediction algorithm predicts the subsequent data behavior and provides an adaptive detection boundary by estimating the behavior trend of the time series. When the data exceeds the prediction range, it is considered as abnormal data.

3) Rate constraint algorithm: Since the time series has one-dimensional time-varying characteristics, the rate-based cleaning method of the rate constraint algorithm adopts the idea that the speed range (that is, the slope) between the front and rear points is limited. If the rate is too large, it means that the current point has Mutation characteristics, considered abnormal data.

4) Density (distance) detection algorithm: Density (distance)-based anomaly detection algorithms are widely used in multi-dimensional big data processing, that is, given a distance threshold, if the number of neighbors of a point in the range is less than the given detection threshold k , it is considered to be abnormal data; converted to unit distance, this method is isomorphic to the detection of user density in the unit space.

However, the above algorithm has the following disadvantages:

1) Boundary detection algorithm: The commonly used boundary detection method is adopted. The detection boundary of each parameter is fixed, and only a few extreme mutation data can be found. It is not sensitive to short-term behavior changes. It is necessary to study algorithms suitable for local anomaly detection. When short-term telemetry data exists Abnormal jump, but does not exceed the boundary range, therefore, the boundary detection algorithm will not be able to detect the abnormal jump, resulting in a situation of missed detection.

2) Trend detection algorithm: Due to high real-time processing requirements and limited on-orbit resources, long-term observation is not allowed to obtain statistical laws, telemetry time series often have non-ideal trends, and short-term statistical results are not stable. Lightweight algorithms for data.

3) Rate detection range: When the time series exhibits random characteristics, the rate changes between the data before and after are irregular and the rate jump is too large, the rate detection cannot work normally, and special processing is required according to the type of telemetry behavior; in addition, the rate detection The boundary is also fixed. For normal data whose short-term rate exceeds the boundary, there is a possibility of misjudgment. It is necessary to study an algorithm suitable for local anomaly detection.

4) Density (distance) detection algorithm: The traditional density (distance)-based algorithm does not consider the influence of the weights of the sequence before and after on evaluating the tightness of the current point. For time-varying sources, although there is a certain correlation between the data before and after. , but this correlation becomes weaker as the interval grows. If this effect is ignored, the value of the abnormal point will be equivalent to the value of the data at a later time, and there is a possibility of misjudgment. It is necessary to study an algorithm that conforms to the correlation characteristics of time series.

The application proposes the following embodiments to solve the above determination, and the specific embodiments are described as follows:

Example 1:

According to an embodiment of the present invention, an embodiment of an abnormality detection method for aircraft telemetry data is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer-executable instructions. and, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that herein.

FIG. 1 is a flowchart of a method for detecting anomalies in telemetry data of an aircraft according to an embodiment of the present invention. As shown in FIG. 1 , the method includes the following steps:

Step S102, obtaining the pilot telemetry data sent by the aircraft, and determining whether the pilot telemetry data is a stationary time series through stationarity detection;

It should be noted that the above-mentioned pilot telemetry data is the telemetry data obtained before the node at the current moment, and the data amount of the pilot telemetry data is small, which can conveniently determine whether the pilot telemetry data is a stationary time series.

Step S104, after completing the stationarity detection, obtain the telemetry data of the node at the current moment sent by the aircraft;

Step S106, if the pilot telemetry data is a stationary time series, use a boundary detection algorithm to detect the telemetry data of the node at the current moment to determine whether the telemetry data of the node at the current moment is abnormal data;

Specifically, the steps of using the boundary detection algorithm to detect the telemetry data of the node at the current moment are as follows:

It is determined whether the telemetry parameter of the telemetry data of the node at the current moment is within the preset boundary range, and if the telemetry parameter of the telemetry data of the node at the current moment is not within the preset boundary range, the telemetry data of the node at the current moment is abnormal data.

Step S108, if the pilot telemetry data is not a stationary time series, use a preset detection algorithm to detect the telemetry data of the node at the current moment to determine whether the telemetry data of the node at the current moment is abnormal data, wherein the The preset detection algorithm includes at least one of the following: a three-point set isomorphic map detection algorithm, and a left and right dual coset weighted map detection algorithm.

In the embodiment of the present invention, by performing stationarity detection on the pilot telemetry data, it is determined whether the pilot telemetry data is a stationary time series, and different detection algorithms are selected according to the detection results to detect the telemetry data of the node at the current moment, so as to determine whether the pilot telemetry data is a stationary time series. Whether the telemetry data of the node at the current moment is abnormal data, the purpose of abnormality detection of telemetry data is achieved, and the technology of abnormal data detection of telemetry data in the prior art is solved with complicated detection steps and low detection accuracy. Therefore, the detection steps of abnormal data detection of telemetry data are simplified, and the technical effect of improving detection accuracy is realized.

In this embodiment of the present invention, as shown in FIG. 2 , the method further includes the following steps:

Step S110, cleaning the abnormal data.

In this embodiment of the present invention, after detecting that the telemetry data of the node at the current moment is abnormal data, first, it is determined that the first target data is the first normal telemetry data before the node at the current moment (that is, the first target data), the second target data is the first normal telemetry data (ie, the second target data) after the node at the current moment.

Then, the average value of the first target data and the second target data is obtained, and then the abnormal data is replaced by the average value, so as to achieve the technical effect of cleaning the abnormal data.

By cleaning abnormal data, the accuracy of telemetry data is improved, and the cleaned telemetry data is used as input data for subsequent feature extraction and elastic compression, which can provide technical support for the development of deep space exploration missions and spatial information networks.

In this embodiment of the present invention, step S108 further includes the following steps:

Step S11, determining the performance type of the aircraft, wherein the performance type includes: a first performance type and a second performance type, and the on-orbit processing capability of the aircraft of the first performance type is lower than that of the second performance type the on-orbit processing capability of the aircraft;

Step S12, determining a target detection algorithm in the preset detection algorithm based on the performance type;

In step S13, the target detection algorithm is used to detect the telemetry data of the node at the current moment to determine whether the telemetry data of the node at the current moment is abnormal data.

In the embodiment of the present invention, in order to simplify the detection steps of abnormal data detection and improve the detection accuracy, when detecting abnormal data, first, it is necessary to determine the performance type of the aircraft that sends the telemetry data of the node at the current moment, and according to Select the corresponding abnormal data detection algorithm for the performance type to detect the telemetry data of the node at the current moment.

If the on-orbit processing capability of the aircraft is weak, the three-point set isomorphic mapping detection algorithm is used to detect the telemetry data of the node at the current moment.

If the on-orbit processing capability of the aircraft is strong, the left and right double coset weighted mapping detection algorithm is used to detect the telemetry data of the node at the current moment.

In the embodiment of the present invention, as shown in FIG. 3 , detecting abnormal data by using a three-point set isomorphic mapping detection algorithm includes the following steps:

Step S21: Determine the neighbor node of the node at the current moment, wherein the neighbor node includes: a first neighbor node and a second neighbor node, the first neighbor node is the neighbor node before the node at the current moment, so The second neighbor node is the neighbor node after the current moment node;

Step S22, use the current moment node and the first neighbor node to construct a first vector line segment, and use the current moment node to construct a second vector line segment constructed by the second neighbor node, and determine the first vector line segment. The angle between the vector line segment and the vector angle formed by the second vector line segment;

Step S23, if the angle is smaller than a preset threshold, the telemetry data of the node at the current moment is abnormal data.

In the embodiment of the present invention, as shown in FIG. 4 , detecting abnormal data by using the left and right bi-coset weighted mapping detection algorithm includes the following steps:

Step S31, constructing the k-ary double coset of the node at the current moment;

Step S32, calculating the distance threshold of the k-yuan double coset, and assigning a value to the node in the k-yuan double coset to obtain the node assignment;

Step S33, determining the tightness factor comparison threshold of the node at the current moment;

Step S34, calculating the tightness of the node at the current moment in combination with the distance threshold of the k-yuan double coset and the node assignment;

Step S35, if the closeness is less than the closeness factor comparison threshold, the telemetry data of the node at the current moment is abnormal data.

The detection process of the above two detection algorithms will be described in detail below in conjunction with Figure 3 and Figure 4:

First, use the three-point set isomorphic mapping detection algorithm to detect abnormal data:

According to the assumption of smooth linearity of local three-point data and the 3σ principle, the normal data should not deviate from the average value of the internal difference of the subsets that is three times the theoretical value (that is, the preset threshold is 72°).

First, it is necessary to determine the neighbor node (ie, the first neighbor node) before the node at the current moment, and determine the neighbor node (ie, the second neighbor node) after the node at the current moment.

Then, connect the node at the current moment and the first neighbor node to construct a first vector line segment, and link the node at the current moment and the second vector line segment constructed by the second neighbor node to form a vector angle.

Next, the angle of the included angle of the vector is determined. If the angle is less than 72°, the telemetry data of the node at the current moment is abnormal data.

If the angle is greater than 72°, the telemetry data of the node at the current moment is normal data.

Second, use the left and right double coset weighted mapping detection algorithm to detect abnormal data:

1. Construct the left/right k-ary double coset of the node at the current moment, where k is a positive integer.

2. Calculate the distance threshold D _l of the left coset and the distance threshold D _r of the right coset. The specific calculation is as follows:

3. Map each moment node in the left/right coset to the current moment node according to the far-near effect with power exponent (α _l ,α _r ) characteristics, each moment node is assigned a weight, p _j =(α _l ) ^j , p _i =(α _r ) ⁱ , that is, time nodes that are close in time have higher weights, and time nodes that are far away in time have low weights (ie, far-near effects).

4. Determine the close factor ratio threshold T of the node at the current moment. The value of T depends on the number of abnormal data that may exist in the neighborhood of the node at the previous moment. When the number of abnormal data is 1, T is 1/2 , when the number of abnormal data is 2, T is 1/2+1/4, and so on. In general, the default is that the number of abnormal data is 1, that is, T=1/2.

5. In the range of the distance threshold (D _l , D _r ), the left and right coset weights are summed to obtain the compact factor C (k, D _l , D _r ), that is, the distance from the current point x in the 2k point data set before and after statistics The sum of the weights whose 1-norm of _n is not greater than the distance threshold is used as the closeness measurement index "closeness factor", as shown in the following formula:

According to the above formula, the tightness of the node at the current moment is calculated.

6. If the above-mentioned tightness is less than the tightness factor ratio judgment threshold T, then the telemetry data of the node at the current moment is abnormal data; if the above-mentioned tightness is greater than or equal to the tightness factor ratio judgment threshold T, then the telemetry data of the node at the current moment is normal. data.

Embodiment 2:

The present invention also provides an embodiment of an abnormality detection device for aircraft telemetry data, which is used to execute the method for detecting abnormality in telemetry data provided by the above content of the embodiments of the present invention. The following is an example of the telemetry data provided by the embodiments of the present invention. The specific introduction of abnormal detection device.

As shown in FIG. 5 , the above-mentioned abnormality detection apparatus for telemetry data includes: a first acquisition unit 10 , a second acquisition unit 20 , a first detection unit 30 and a second detection unit 40 .

The first acquisition unit 10 is configured to acquire pilot telemetry data sent by the aircraft, and determine whether the pilot telemetry data is a stationary time series through stationarity detection;

The second obtaining unit 20 is configured to obtain the telemetry data of the node at the current moment sent by the aircraft after the stationarity detection is completed;

The first detection unit 30 is configured to use a boundary detection algorithm to detect the telemetry data of the node at the current moment when the pilot telemetry data is a stationary time series, and determine whether the telemetry data of the node at the current moment is abnormal data. ;

The second detection unit 40 is configured to use a preset detection algorithm to detect the telemetry data of the node at the current moment when the pilot telemetry data is not a stationary time series, and determine the telemetry data of the node at the current moment. Whether it is abnormal data, wherein the preset detection algorithm includes at least one of the following: a three-point set isomorphic mapping detection algorithm, and a left and right dual coset weighted mapping detection algorithm.

In the embodiment of the present invention, by performing stationarity detection on the pilot telemetry data, it is determined whether the pilot telemetry data is a stationary time series, and different detection algorithms are selected according to the detection results to detect the telemetry data of the node at the current moment, so as to determine whether the pilot telemetry data is a stationary time series. Whether the telemetry data of the node at the current moment is abnormal data, the purpose of abnormality detection of telemetry data is achieved, and the technology of abnormal data detection of telemetry data in the prior art is solved with complicated detection steps and low detection accuracy. Therefore, the detection steps of abnormal data detection of telemetry data are simplified, and the technical effect of improving detection accuracy is realized.

Preferably, the device further includes: a data cleaning unit, configured to clean the abnormal data.

Preferably, the data cleaning unit is configured to: determine first target data and second target data, wherein the first target data is the first normal telemetry data before the node at the current moment, and the second target data is the first normal telemetry data before the node at the current moment. The target data is the first normal telemetry data after the node at the current moment; the average value of the first target data and the second target data is calculated, and the abnormal data is replaced with the average value.

Preferably, the second detection unit is used to: determine a performance type of the aircraft, wherein the performance type includes: a first performance type and a second performance type, and the on-orbit processing of the aircraft of the first performance type The on-orbit processing capability of the aircraft whose capability is lower than the second performance type; the target detection algorithm in the preset detection algorithm is determined based on the performance type; the target detection algorithm is used to detect the node at the current moment The telemetry data of the node is detected to determine whether the telemetry data of the node at the current moment is abnormal data.

Preferably, the second detection unit is configured to: if the performance type of the aircraft is the first performance type, the target detection algorithm is the three-point set isomorphic mapping detection algorithm; if the performance type of the aircraft is the second performance type, the target detection algorithm is the left and right dual coset weighted mapping detection algorithm.

Preferably, if the target detection algorithm is the three-point set isomorphic mapping detection algorithm, the second detection unit is configured to: determine the neighbor nodes of the node at the current moment, wherein the neighbor nodes include: a neighbor node and a second neighbor node, the first neighbor node is the neighbor node before the current moment node, and the second neighbor node is the neighbor node after the current moment node; using the current moment node and The first neighbor node constructs a first vector line segment, and uses the second vector line segment constructed by the second neighbor node of the current moment node, and determines that the first vector line segment and the second vector line segment constitute If the angle is smaller than the preset threshold, the telemetry data of the node at the current moment is abnormal data.

Preferably, if the target detection algorithm is the left and right dual coset weighted mapping detection algorithm, the second detection unit is used for: constructing a k-ary dual coset of the node at the current moment; calculating the k-ary dual coset The distance threshold of the coset, and assigning values to the nodes in the k-ary double coset to obtain the node assignment; determining the closeness factor ratio judgment threshold of the node at the current moment; combining the distance threshold of the k-ary double coset and all The node assignment is performed to calculate the tightness of the node at the current moment; if the tightness is less than the tightness factor comparison threshold, the telemetry data of the node at the current moment is abnormal data.

Preferably, the first detection unit is configured to: determine whether the telemetry parameter of the telemetry data of the node at the current moment is within a preset boundary range; if not, the telemetry data of the node at the current moment is abnormal data.

The embodiment of the present application also provides a computer-readable medium having a non-volatile program code executable by a processor, the program code enables the processor to execute the abnormality detection method for aircraft telemetry data described in the first embodiment.

In addition, in the description of the embodiments of the present invention, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it may be a fixed connection or a detachable connection , or integrally connected; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or the internal communication between the two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood in specific situations.

In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. The indicated orientation or positional relationship is based on the orientation or positional relationship shown in the accompanying drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the indicated device or element must have a specific orientation or a specific orientation. construction and operation, and therefore should not be construed as limiting the invention. Furthermore, the terms "first", "second", and "third" are used for descriptive purposes only and should not be construed to indicate or imply relative importance.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. The apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces, indirect coupling or communication connection of devices or units, which may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present invention, and are used to illustrate the technical solutions of the present invention, but not to limit them. The protection scope of the present invention is not limited thereto, although referring to the foregoing The embodiment has been described in detail the present invention, those of ordinary skill in the art should understand: any person skilled in the art who is familiar with the technical field within the technical scope disclosed by the present invention can still modify the technical solutions described in the foregoing embodiments. Or can easily think of changes, or equivalently replace some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be covered in the present invention. within the scope of protection. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. A method of anomaly detection of aircraft telemetry data, comprising:

acquiring pilot telemetering data sent by an aircraft, and determining whether the pilot telemetering data is a stationary time sequence or not through stationary detection;

after stationarity detection is finished, acquiring telemetering data of a node at the current time, which is sent by an aircraft;

if the pilot telemetering data is a stable time sequence, detecting the telemetering data of the node at the current moment by using a boundary detection algorithm, and determining whether the telemetering data of the node at the current moment is abnormal data;

if the pilot telemetering data is not a stationary time sequence, detecting the telemetering data of the current time node by using a preset detection algorithm, and determining whether the telemetering data of the current time node is abnormal data, wherein the preset detection algorithm comprises at least one of the following: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.

2. The method of claim 1, further comprising:

and cleaning the abnormal data.

3. The method of claim 2, wherein cleansing the anomaly data comprises:

determining first target data and second target data, wherein the first target data is first normal telemetering data before the node at the current moment, and the second target data is first normal telemetering data after the node at the current moment;

calculating a mean value of the first target data and the second target data, and replacing the abnormal data with the mean value.

4. The method of claim 1, wherein detecting the telemetry data of the current time node by using a preset detection algorithm to determine whether the telemetry data of the current time node is abnormal data comprises:

determining a performance type of the aircraft, wherein the performance type comprises: a first performance type and a second performance type, the in-orbit handling capability of the aircraft of the first performance type being lower than the in-orbit handling capability of the aircraft of the second performance type;

determining a target detection algorithm in the preset detection algorithms based on the performance type;

and detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data.

5. The method of claim 4, wherein determining a target detection algorithm of the predetermined detection algorithms based on the performance type comprises:

if the performance type of the aircraft is a first performance type, the target detection algorithm is the three-point set isomorphic mapping detection algorithm;

and if the performance type of the aircraft is a second performance type, the target detection algorithm is the left and right double-coset empowerment mapping detection algorithm.

6. The method of claim 5, wherein if the target detection algorithm is the three-point set isomorphic mapping detection algorithm;

detecting the telemetering data of the current time node by using the target detection algorithm, and determining whether the telemetering data of the current time node is abnormal data, wherein the method comprises the following steps:

determining a neighbor node of the current time node, wherein the neighbor node comprises: the first neighbor node is a neighbor node before the node at the current moment, and the second neighbor node is a neighbor node after the node at the current moment;

constructing a first vector line segment by using the current time node and the first neighbor node, constructing a second vector line segment by using the current time node and the second neighbor node, and determining the angle of a vector included angle formed by the first vector line segment and the second vector line segment;

and if the angle is smaller than a preset threshold value, the telemetering data of the node at the current moment is abnormal data.

7. The method according to claim 5, wherein if the target detection algorithm is the left-right double coset empowerment mapping detection algorithm;

detecting the telemetering data by using the target detection algorithm to determine abnormal data in the telemetering data, wherein the method comprises the following steps:

constructing a k-element double coset of the node at the current moment;

calculating a distance threshold of the k-element double coset, and assigning a node in the k-element double coset to obtain a node assignment;

determining a tightness factor comparison threshold value of the node at the current moment;

calculating the compactness of the node at the current moment by combining the distance threshold of the k-element double coset and the node assignment;

and if the compactness is smaller than the compactness factor comparison threshold, the telemetering data of the node at the current moment is abnormal data.

8. The method of claim 1, wherein detecting telemetry data of a node at a current time using a boundary detection algorithm to determine whether the telemetry data of the node at the current time is abnormal data comprises:

determining whether the telemetry parameters of the telemetry data of the node at the current moment are within a preset boundary range;

and if not, the telemetering data of the node at the current moment is abnormal data.

9. An anomaly detection device for aircraft telemetry data, comprising: a first acquisition unit, a second acquisition unit, a first detection unit and a second detection unit, wherein,

the first acquisition unit is used for acquiring pilot telemetering data sent by an aircraft and determining whether the pilot telemetering data is a stationary time sequence or not through stationarity detection;

the second acquisition unit is used for acquiring the telemetering data of the node at the current moment sent by the aircraft after the stationarity detection is finished;

the first detection unit is used for detecting the telemetering data of the node at the current moment by using a boundary detection algorithm under the condition that the pilot telemetering data is a stable time sequence, and determining whether the telemetering data of the node at the current moment is abnormal data;

the second detection unit is configured to, if the pilot telemetry data is not a stationary time series, detect the telemetry data of the current time node by using a preset detection algorithm, and determine whether the telemetry data of the current time node is abnormal data, where the preset detection algorithm includes at least one of: a three-point set isomorphic mapping detection algorithm and a left and right double-coset empowerment mapping detection algorithm.

10. A computer-readable medium having non-volatile program code executable by a processor, the program code causing the processor to perform the method of anomaly detection of aircraft telemetry data as claimed in any one of claims 1 to 8.

Images