The complexity and dynamism of business management system pose higher requirements for the accuracy and timeliness of fault diagnosis. This paper proposes a compensation distance evaluation technique-kernel principal component analysis-convolutional neural network-bidirectional long short-term memory network (CDETKPCA-CNN-BiLSTM) that integrates attention mechanism to address the limitations of traditional diagnostic methods in nonlinear and high-dimensional data scenarios. The bidirectional long short-term memory (BiLSTM) layer and attention mechanism layer further improve the accuracy and reliability of fault diagnosis. Feature extraction is performed in business management system data from both time and frequency domains, effectively utilizing temporal information to form an initial feature set. To address the issue of data redundancy in business management system, a compensation distance evaluation technique and kernel principal component analysis (CDETKPCA) feature fusion method is proposed. Through CDET, the initial feature set is screened and weighted to guide KPCA feature fusion processing, generating a fused feature set for subsequent fault diagnosis research. The experimental results show that CDETKPCA-CNN-BiLSTM can extract effective information more efficiently and significantly improve analysis accuracy. And this provides a new technical method for fault diagnosis in business management system.
bidirectional long short-term memorybusiness management systemconvolutional neural networkfault diagnosisfeature extraction fusionThe author(s) declared that financial support was not received for this work and/or its publication.section-at-acceptanceSocial PhysicsHighlights
This paper proposes a fault diagnosis network model that integrates attention mechanism and conducts diagnostic research on fault feature quantities of business management system.
By conducting multiple simulation experiments, it is verified that the model has better system fault diagnosis capabilities and can effectively enhance the safety fault diagnosis effect of business management system.
Introduction
In the highly digitized global economic landscape, the operational efficiency, decision-making quality and market competitiveness of enterprises are unprecedentedly dependent on the stability of their information system. The business management system, as the core hub of enterprise informatization, has evolved from an early single function business processing tool to a comprehensive and integrated platform that integrates multiple key functions. It not only supports the smooth operation of daily operations, but also serves as the cornerstone for enterprises to make precise strategic decisions, optimize resource allocation, improve service quality and build core competitive advantages.
However, modern business management system themselves are also facing severe challenges brought by unprecedented complexity and vulnerability. The system scale is rapidly expanding, often containing dozens or even hundreds of tightly coupled and interdependent microservices or functional modules, spanning diverse technology stacks. Any seemingly small component failure can lead to a cliff like decline in local performance or even global service paralysis. The daily volume of operational data generated and processed by the system shows exponential growth, covering structured transaction data, semi-structured log files, unstructured user behavior data and massive performance monitoring indicators. The massive and heterogeneous nature of this data makes it difficult for traditional methods based on preset rules or simple statistical analysis to deeply explore the weak signals and complex patterns that indicate potential faults contained within them [1].
However, the manifestations of system failures are becoming increasingly covert and interconnected. The response delay and throughput drop caused by performance bottlenecks, untraceable data inconsistency, unexpected blocking of critical business processes and even covert abnormal behavior resulting from the exploitation of security vulnerabilities [2, 3]. This type of fault usually has the characteristics of long latency, intermittent attacks and vague symptom manifestations. Multiple seemingly isolated indicators or log alarms are often driven by the same complex root cause and the difficulty of diagnosis increases exponentially. The core pain point of all these challenges is that any serious malfunction of the business management system is directly linked to the continuity of the enterprise’s core business processes. An unexpected interruption of a critical system may result in order loss and cause irreparable damage to the company’s reputation.
Faced with these increasingly severe challenges, the current mainstream fault diagnosis methods are increasingly showing their inherent limitations. Traditional system based on rule bases or expert experience [4] heavily rely on pre-set, often static rules and accumulated case knowledge by operations personnel. This method has high maintenance costs and is difficult to keep up with the frequent iteration and updates of the system. Its flexibility and adaptability are severely lacking, making it unable to effectively respond to the constantly emerging new or complex combination failure modes. More commonly, there are a large number of false positives that interfere with effective judgment, or serious false negatives that lead to critical faults being ignored [5, 6]. The method based on statistical analysis or static threshold alarm, although relatively simple to implement, is too extensive. It usually only focuses on isolated changes in a single indicator, sets a fixed threshold and triggers an alarm once it is exceeded. This approach completely ignores the dynamic and nonlinear interrelationships and collaborative change patterns between indicators. Some advanced methods attempt to introduce simple machine learning models, such as Support Vector Machines (SVM) or Decision Trees [7]. These methods make progress compared to the previous two and can handle a certain degree of nonlinear relationships. However, when faced with the truly massive, high-dimensional and strongly temporal correlated monitoring data generated by business management system, they also expose obvious shortcomings, requiring a lot of effort to carry out tedious and highly domain dependent manual feature engineering. The expressive power and complexity of the model itself are limited, making it difficult to capture the deep and abstract fault patterns hidden behind the vast data.
It is in this context that the area of artificial intelligence, especially deep learning technology, provides powerful theoretical weapons [8, 9]. It can automatically learn and abstract highly discriminative feature representations layer by layer directly from raw or preprocessed system monitoring data. This end-to-end feature learning capability completely abandons the time-consuming and labor-intensive manual feature engineering process that heavily relies on expert experience in traditional methods. It can efficiently handle the massive, multi-source and heterogeneous data unique to business management system. In deep learning, CNNs that excel at capturing spatial local correlations and pattern recognition [10] are applied to analyze the image representations or performance metric topologies transformed from system call sequences. The recurrent neural network (RNN) designed specifically for sequential data and its powerful improved variants [11], such as long short-term memory networks (LSTM) and gated recurrent units (GRU), perform well in handling time-dependent indicator sequences and continuous log event streams, effectively modeling long-distance temporal dependencies and identifying periodic and trend anomalies.
The development of fault diagnosis technology has gone through an evolution from being driven by manual experience to being driven by data intelligence. Early research applies SVM to customer churn warning in system, detecting anomalies in transaction data. However, machine learning methods still rely on manually designed features, making it difficult to automatically extract complex patterns from high-dimensional data. And this has insufficient ability to capture long-term dependencies when processing time-series data. The emergence of deep learning has brought about a revolution in fault diagnosis. CNN has significant advantages in feature extraction of data such as images and speech, while RNN and its variants LSTM and GRU effectively solve the problem of gradient vanishing in temporal data and are widely used in multiple fields. In business management system, previous studies have attempted to use LSTM to detect financial indicator anomalies and CNN to classify system log text. However, existing research still has limitations such as model singularity, insufficient feature utilization and insufficient interpretability.
In summary, as the lifeline of modern enterprise operation, the stability and efficiency of the business management system are the cornerstone of the successful digital transformation of enterprises. However, the increasing complexity of the system and the flood of data make traditional fault diagnosis methods difficult to withstand. The flourishing development of deep learning technology has brought disruptive opportunities to solve this bottleneck problem. This paper designs a deep learning model by integrating CNN, BiLSTM and attention mechanism to achieve multi-level feature extraction and deep semantic understanding of business management system data. Our main contributions are summarized as follows.
This paper proposes a CDETKPCA-CNN-BiLSTM fault diagnosis network model that integrates attention mechanism and conducts diagnostic research on fault feature quantities of business management system. In data fault diagnosis, the BiLSTM layer outperforms LSTM in bidirectional feature extraction, the attention mechanism further enhances the fault diagnosis capability of the business management system by focusing on key features.
The CDETKPCA-CNN-BiLSTM performs feature extraction from both time and frequency domains and successfully extracts feature data from business management system. And this paper proposes the CDETKPCA feature fusion method, which uses non-linear mapping of kernel principal component analysis to process complex correlations between features and generate a fused feature set. This provides effective data support for fault diagnosis in business management system.
By conducting multiple simulation experiments, it is verified that CDETKPCA-CNN-BiLSTM has better system fault diagnosis capabilities and can effectively enhance the safety fault diagnosis effect of business management system.
The rest of this paper consists of four parts. Section 2 is related literature related to the work. Section 3 systematically elaborates on the system fault diagnosis and analysis capabilities of CDETKPCA-CNN-BiLSTM for business management system, conducts comprehensive and in-depth discussions based on practical application scenarios. Section 4 designs comparative experiments for testing and analysis. Finally, Section 5 is the summary.
Literature review
Deep learning had a strong development momentum since its inception, with powerful data processing and learning capabilities making it outstanding in many fields. It had also spawned several types of neural networks such as CNN, RNN, Convolutional Deep Belief Networks (CDBN) and so on. Zhao et al. [12] used Faster RCNN network for drone image recognition to diagnose transmission line faults, achieving multi-target fault detection in complex backgrounds through data mining techniques. Boubaker et al. [13] evaluated the use of machine learning and deep learning for fault detection and diagnosis of photovoltaic modules, demonstrating that deep learning had better accuracy.
In recent years, deep learning technology had made significant breakthroughs in fields such as image and natural language processing due to its powerful feature learning ability. This trend had also prompted scholars to explore its innovative applications in the field of fault diagnosis [14]. And scholars had applied CNN to the fault diagnosis neighborhood. Piedad et al. [15] proposed a CNN-based fault diagnosis method for asynchronous motors, which relied only on the stator current signal of the motor and combined it with a CNN based on frequency occurrence graph to achieve accurate diagnosis of asynchronous motor faults. Dibaj et al. [16] proposed an end-to-end fault diagnosis method based on fine-tuning variational mode decomposition and CNN. The method first preprocessed the vibration signal through fine variational mode decomposition. And then it used the training results of CNN to achieve feature extraction. Chen et al. [17] proposed a rolling bearing diagnosis method based on cyclic spectral coherence and CNN. Subsequently, CNN was constructed based on the features for deeper feature learning and classification. Huang et al. [18] proposed a novel fault diagnosis method based on CNN-LSTM and sliding window. It input the samples into CNN-LSTM for diagnosis, reducing the adverse effects of time delay on fault diagnosis results. Hoang et al. [19] proposed a fault diagnosis method that combined CNN and decision level fusion technology. By extracting features from multi-phase current signals of motors and classifying them, high-precision bearing fault diagnosis was achieved by fusing information from multiple CNNs. Zhang et al. [20] proposed a method that integrated CNN and Bidirectional Gated Recurrent Unit (BiGRU), constructed a monitoring model that could automatically extract spatiotemporal features from multi-source data. This solved the real-time monitoring problem of uneven wear in high-speed train braking system. Huang et al. [21] proposed a fault diagnosis method based on 1D-CNN for identifying the fault state of train bogies and locating the position of faulty components. By improving the fully adaptive noise set empirical mode decomposition, the original vibration signal of the train bogie was decomposed into multiple intrinsic mode functions. And high-frequency components were selected as fault features. Zhang et al. [22] proposed a multi-class wind turbine bearing fault diagnosis model based on Conditional Generative Adversarial Network (CVAE-GAN). And then it used wavelet transform to fuse the multi-source two-dimensional signals together. Dong et al. [23] proposed a fault diagnosis method for train traction inverters based on LSTM. This method could use the ability of LSTM to process long data sequences to fuse pre and post information. Experimental results showed that this method exhibited high sensitivity to different signals in both single sensor and multi-sensor modes.
Research on fault diagnosis analysis of business management system driven by deep learningCDETKPCA-CNN-BiLSTM fusion attention mechanism deep learning network
The CDETKPCA-CNN-BiLSTM consists of CDETKPCA unit, 3*1D-CNN layer, BiLSTM layer, attention layer, fully connected layer and Softmax classification layer. The fault data of the business management system is input into the CDETKPCA unit. And the fused feature sets obtained in the feature extraction and fusion stage are input into the CNN layer, which extracts the sequence features of the fault feature components. The extracted sequence features are input into BiLSTM, further extract fault sequence features through the forward and backward propagation LSTM layers in BiLSTM.After the extracted fault sequence features are input into the attention layer, the model assigns higher weights to sequence features that better reflect the type of fault through attention mechanisms. On this basis, further screening of fault characteristics is carried out to improve the correlation between fault characteristics and fault types. Finally, the weighted feature quantities are fed into the fully connected layer and Softmax layer [24] for fault classification, as shown in the flowchart in Figure 1.
CDETKPCA-CNN-BiLSTM flowchart.
Flowchart illustrating a fault diagnosis process that begins with business management system data input, processed through CDET-KPCA, three one-dimensional convolutional neural networks, a bidirectional LSTM with forward and backward paths, attention mechanism, fully connected Softmax, and outputs a fault type.
The hidden layer dimension hidden-dim of BiLSTM is set to 64 based on data complexity. If the dimension is too large, it increases the computational load, while if it is too small, it cannot capture complex fault timing patterns. The number of layers num_layers is set to 2, which not only meets the requirements of complex sequence modeling but also avoids gradient vanishing caused by too many layers. The system monitoring data with sequence length seq_len measured in hours is set to 12. In terms of training hyperparameters, the batch size batch_2 is set to 32 to balance training efficiency and gradient stability. The initial value of learning rate lr is set to 1e-4 and is dynamically adjusted using the Adam adaptive optimizer. The Dropout rate is set to 0.4 to suppress overfitting and the optimizer chooses Adam. During the training process, a cross entropy loss function is used and is combined with the early stopping method to prevent overfitting.
Feature extraction of business management system data
In the process of fault diagnosis and analysis in business management system, feature extraction is the core link of data processing. Through relevant algorithms and technologies, key information is extracted from raw data and transformed into more representative, easier to understand and process feature representation forms. This process helps to discover the inherent patterns and patterns of data in business management system, reducing redundant information. In the process of feature extraction, in response to the temporal characteristics of business management system data, this paper adopts a method of feature extraction from both time domain and frequency domain perspectives. Time domain features are the direct carriers for capturing the timing and evolution process of faults, such as the gradual increase in latency of memory leaks. Frequency domain features can reveal hidden faults under normal business cycles, such as the amplitude increase of timed memory overflow. The combination of the two can serve as a bridge for cross module fault correlation and neither are indispensable.
Time domain feature extraction
Time domain feature extraction is a widely used technique in system data processing [25], which mainly focuses on the characteristics of business management system data on the time axis. By analyzing and processing the changes of system data in the time domain, key features such as amplitude and period of business management system data are extracted for subsequent processing, analysis and application.
This paper focuses on the operational status, business processes, user behavior and other dimensions of the business management system. Ten time domain feature indicators are extracted, such as maximum, minimum and mean, to represent the overall strength, as shown in Formula 1.Mean=1n∑i=1nxi
The root mean square value represents the power level, as shown in Formula 2.Rms=1n∑i=1nxi2
Variance and standard deviation represent the degree of dispersion of changes, as shown in Formulas 3, 4.Var=1n∑i=1nxi−X¯2Std=1n∑i=1nxi−X¯2
The peak to peak value is the absolute difference between the maximum positive and negative offsets experienced during its complete cycle, representing the amplitude of the fluctuation and skewness represents the symmetry of the distribution, as shown in Formula 5.Skew=∑i=1nxi−X¯3n−1SD3
The kurtosis represents the steep and gentle distribution state as shown in Formula 6.Kurt=∑i=1nxi−X¯4n−1SD4−3
The peak value represents the range of data variation, as shown in Formula 7.CF=XmaxXrms
Before extracting feature parameters from the raw data of the business management system faults, this paper also carries out preprocessing processes such as discrete number coding and missing value processing [26]. By extracting temporal features from multi-channel business management system data, multiple temporal features are extracted to provide powerful data support for subsequent fault diagnosis.
Frequency domain feature extraction
Frequency domain feature extraction utilizes Fourier transform to transform time domain signals into frequency domain representations [27], thereby extracting frequency related information. By analyzing the frequency components of business management system data, we can understand the distribution of data at different frequencies and the intensity of each frequency component, revealing the characteristics of business management system data in the frequency domain.
This paper focuses on extracting six frequency domain features from business management system data. They are as follows. The center frequency represents the position of the frequency center, as shown in Formula 8.FC=Σk=1NfkskΣk=1Nsk
The mean square frequency represents the overall strength, as shown in Formula 9.MSF=∑k=1Nfk2sk∑k=1Nsk
The frequency variance and frequency standard deviation represent the degree of dynamic change, as shown in Formulas 10, 11.VF=∑k=1Nfk−F132sk∑k=1NskRVF=∑k=1Nfk−F132sk∑k=1Nsk
The root mean square frequency represents the change in frequency band position, as shown in Formula 12.RMSF=∑k=1Nfk2sk∑k=1Nsk
The average frequency amplitude represents the average distribution of frequency, as shown in Formula 13.FVM=1N∑k=1Nsk
Data feature fusion of business management system
There are irrelevant and redundant features in the high dimensional features obtained through feature extraction from two aspects. Too many features increase the computational complexity and training time of the model. Therefore, it is necessary to optimize the selection of features, remove redundant features, in order to reduce computation time, improve training efficiency and fault recognition accuracy.
Feature selection and feature fusion have a significant impact on optimizing the feature space and improving the performance of subsequent fault diagnosis. Feature selection is the process of selecting the most relevant and valuable subset of features from the original feature set, with the aim of reducing the complexity of deep learning models while maintaining or improving model performance. Feature fusion is the process of combining multiple features or subsets of features into a new feature set, which includes direct combination, transformation or extraction of new high level features. The purpose of feature fusion is to enhance the expressive power of features, so that the new feature set can better describe the inherent rules and structure of data, thereby improving the learning and generalization ability of deep learning models.
In the optimization selection process of data feature vectors in the business management system, this paper uses CDET [28] to screen features that significantly contribute to classification performance. Subsequently, by weighting the selected feature vectors, a weighted feature set is constructed to further enhance the influence of key features in classification decisions, thereby significantly improving classification performance.
Due to the non-linear nature of data in business management system, this paper employs KPCA [29] for feature dimensionality reduction. KPCA uses kernel functions to map the weighted feature set to a high dimensional feature space, thereby transforming nonlinear relationships that are previously difficult to handle in the original space into linearly separable forms in the high dimensional space.
CDET
CDET evaluates the sensitivity and importance of features by calculating the distance between feature vectors. CDET not only considers the differences between features, but also balances the feature distribution between different classes by introducing compensation factors, thereby more accurately selecting features that contribute significantly to classification performance. The feature selection process based on CDET is as follows.
The average distance of all feature vectors is calculated in the state mode, as shown in Formula 14.
dc,k=1Sc×Sc−1∑i=1Sc∑j=1ScPc,i,k−Pc,j,k
In the c state mode, Pc,i,k represents the k features of the i-th sample. Sc is the total number of samples in the c state, k is the number of features per sample. The number of samples in the c state mode is Sc×C, resulting in a total of Sc×C×K features. The average intra class distance is the average of the distances dc,k between all samples within the same state mode, as shown in Formula 15.dkw=1C∑c=1Cdc,k
We define and calculate the variance factor of dcw, as shown in Formula 16.
vkw=maxdc,kmindc,k
The class distance between C state patterns is calculated, as shown in Formula 17.
dkb=1C×C−1∑c=1C∑e=1Cμe,k−μc,k
The μc,k is the mean of the k th feature in all samples, as defined in Formula 18.μc,k=1Sc∑s=1ScPc,s,k
The variance factor of dkb is defined and calculated, as shown in Formula 19.
vkb=maxμe,k−μc,kminμe,k−μc,k,e,c=1,2,⋯;C;e≠c
We define and calculate the compensation factor as shown in Formula 20.
γk=1vkwmaxvkw+vkbminvkb
We define and calculate distance evaluation indicators as shown in Formula 21.
ak=γkdkbdkw
The normalized processing of ak is carried out to obtain the compensation distance evaluation index, as shown in Formula 22.ak′=akmaxak
We set the threshold ϕ (ϕ∈0,1) and select the features with ak′≥ϕ from the feature set to form the fault diagnosis sensitive feature set.
Feature fusion method for business management system based on CDETKPCA
CDET can filter out features that significantly contribute to classification performance from high dimensional feature vectors and construct an optimized feature space. Given that different features have varying impacts on classification tasks, a feature weighting strategy is further employed to enhance the influence of key features in classification decisions by increasing their weights, thereby significantly improving overall classification performance. The KPCA method not only effectively reduces the dimensionality of the feature space and reduces computational complexity, but also maximizes intra class compactness and inter class separability by optimizing kernel function parameters, achieving efficient fusion of feature vectors. This process not only preserves key information in the business management system data, but also makes the reduced dimensional features more suitable for classification tasks.
In the feature fusion method process of CDETKPCA, during the processing of training samples, CDET is used to conduct a thorough analysis of the feature vectors in the training set. This involves calculating the compensation distance evaluation index aK′k=1K for each feature and screening out sensitive features based on a preset threshold. In this paper, the threshold ϕ is set to 0.4.
After selecting the sensitive feature set through CDET, for further improving the performance of the classification model, it is necessary to allocate weights to the sensitive features. Although these features are recognized as having a significant impact on classification, their respective contributions to classification performance are not the same. To address this, the paper employs a specialized weight calculation method to conduct a CDET analysis on the set of sensitive features, assessing the relative importance of each sensitive feature in the classification task. This approach assigns a weight value ω∈0,1 to each sensitive feature, which directly reflects the extent to which the feature contributes to improving diagnostic accuracy.
Theoretically, the compensation distance evaluation metrics derived from the full feature set can be directly used as weight references. However, this approach overlooks the potential interference of non sensitive features in the weight allocation, as these features may not be directly related to the core elements of the classification task. To ensure the accuracy and relevance of the weight scale, this paper conducts independent CDET analyses on the set of sensitive features to achieve more precise and effective feature weights.
For the obtained sensitive feature set OcR, the feature weights ω=ωnn=1N are calculated using CDET, where N is the dimension of the sensitive feature set. The obtained sensitive feature set ωOcR=ω1O1,ω2O2,...,ωNON is obtained. Finally, KPCA is used to perform feature fusion on each sample, further compressing the feature space to remove redundant information while retaining the most critical features for the classification task. Feature fusion not only reduces computational complexity but also enhances the expressive power of the features, providing strong support for subsequent fault diagnosis tasks. When selecting the kernel parameter of KPCA, the intra class distance index J is used, as shown in Formula 23.J=argmaxSB/SW
The SB and SW correspond to the inter class distance and intra class distance of the feature set respectively. So the generalization ability and accuracy of the classifier are improved.
The number of principal components in the model parameters, n_components is determined based on the variance explanatory power, retaining over 95% of the variance. The kernel function type in hyperparameters is selected as RBF kernel and the subsequent optimization of RBF kernel is carried out through Bayesian optimization. The regularization coefficient alpha is set to 1e-4 to suppress data noise and balance feature extraction and noise filtering. Feature screening and fusion first use CDET to calculate the compensation distance evaluation index of features, set a threshold of ϕ = 0.4 to screen sensitive features and assign weights. Then input the weighted sensitive features into KPCA for nonlinear dimensionality reduction to generate a fused feature set.
Experiment and result analysisExperiment setup
The detailed experimental environment information of this paper is shown in Table 1, including the hardware configuration and software environment used in the experiment.
Experimental environment.
Experimental environment
Configuration information
CPU
Intel Corei5 - 12400 KF
GPU
NVIDA GeForce GTX3060
Operating system
Windows11
PyTorch
PyTorch 1.12
Python
Python 3.11
Cuda
CUDAtoolkit 11.1
The main evaluation indicators for the research experiment on fault diagnosis of business management system include accuracy, precision, recall and F1-score [30, 31], as shown in Table 2. Accuracy is the proportion of correctly diagnosed samples to the total sample size. The higher the value, the stronger the model’s ability to distinguish between normal and fault situations and the better the diagnostic effect. Precision is the proportion of truly faulty samples identified by the model as faults. The higher the precision, the greater the proportion of actual faults identified by the model, which can reduce false positives and improve diagnostic reliability. The recall rate refers to the proportion of actual fault samples in the dataset that are successfully identified by the model. The higher the recall rate, the stronger the model’s ability to detect real faults and avoid missing fault information. The F1-score comprehensive accuracy and recall are obtained through harmonic averaging. The higher the value, the better the model performs in balancing accurate diagnosis and comprehensive fault detection. And this can more comprehensively reflect the fault diagnosis performance.
Experimental indicators.
Indicator name
Formula
Accuracy
Accuracy=TP+TNTP+TN+FN+FP
Recall
Recall=TPTP+FN
Precision
Precision=TPTP+FP
F1-score
F1=2×Precision×RecallPrecision+Recall
We select datasets CIC-IDS2017 and NSL-KDD. Data cleaning first organizes CIC-IDS2017 and NSL-KDD into structured numerical matrices and maps business features. KNN interpolation is used to fill missing values for continuous features and mode filling is adopted for discrete ones. Quartile truncation is used to handle outliers. After removing duplicate and highly redundant samples, Z-Score normalization is performed. Feature engineering extracts 10 statistical features from the time domain and 6 Fourier transform features from the frequency domain. Sensitive features are screened by CDET and weighted through secondary analysis. Finally, the features are reconstructed into a sequence format adapted to BiLSTM, based on the spatiotemporal characteristics of system faults, the interference of redundant features and the input requirements of the model for time-series data.
Experimental resultsAccuracy status
The dataset is the CIC-IDS2017 [32], which is fed into a deep learning network with CDETKPCA-CNN-BiLSTM fusion attention mechanism for training. We set the number of iteration epochs to 200, the learning rate to 0.001, the neural network optimizer to AdamW and use the cross entropy loss function. The diagnostic accuracy curve and loss function curve of the CDETKPCA-CNN-BiLSTM model for fault diagnosis are displayed in Figures 2, 3.
Diagnostic accuracy curve of CDETKPCA-CNN-BiLSTM fusion attention mechanism.
Line graph tracking accuracy percentage versus epoch count from zero to two hundred. Accuracy rises sharply to around ninety-five percent, then gradually increases, maintaining between ninety-five and ninety-eight percent toward the end. A legend labels the plotted line as accuracy.
Loss function curve of CDETKPCA-CNN-BiLSTM fusion attention mechanism.
Line chart illustrating loss over two hundred epochs, showing a rapid decrease in loss during the initial epochs followed by stabilization, indicating effective training optimization and convergence of the model.
Analyzing Figures 2, 3 above, it can be observed that the diagnostic accuracy rapidly increases during the 0–30 rounds of training. This gradually slows down during the 30–70 rounds of training and increases very slowly after 70 rounds until it remains almost unchanged, ultimately maintaining a diagnostic accuracy of around 97.3%. The diagnostic loss value rapidly decreases during the 0–30 rounds of training, gradually slows down afterwards. It remains basically unchanged during the 65–200 rounds, indicating that the diagnostic state of the CDETKPCA-CNN-BiLSTM deep learning neural network reaches its optimal state.
Fault diagnosis results
The confusion matrix of CDETKPCA-CNN-BiLSTM deep learning neural network is shown in Figure 4. It can be clearly seen that the deep learning network with CDETKPCA-CNN-BiLSTM fusion attention mechanism has outstanding diagnostic accuracy for various fault states. Its individual diagnostic ability for various faults reaches over 96%.
Fault diagnosis confusion matrix of CDETKPCA-CNN-BiLSTM fusion attention mechanism.
Confusion matrix heatmap with true labels on the y-axis and predicted labels on the x-axis, showing six categories. Diagonal elements are highest, all above ninety-six percent, indicating strong model accuracy. Color bar on the right shows intensity from light blue to dark blue, corresponding to lower and higher percentages, respectively.Model comparison experiment results
For better demonstrating the effectiveness of CDETKPCA-CNN-BiLSTM in identifying DoS attacks and port scan attacks, this paper also use the NSL-KDD dataset [33]. Both NSL-KDD and CIC-IDS2017 contain samples of DoS attacks, port scan attacks and other types of attacks. To comprehensively verify the effectiveness of the CDETKPCA-CNN-BiLSTM fusion attention mechanism deep learning model on the dataset, we select classic deep neural network models and models proposed in recent years for comparison, including CNN [34], CNN-LSTM [35] and BiLSTM [36]. The results are displayed in Table 3 and Figure 5. The deep learning model of CDETKPCA-CNN-BiLSTM fusion attention mechanism, abbreviated as CDETKPCA-CNN-BiLSTM.
Comparison of overall evaluation indicators of various models in NSL-KDD.
Dataset
Model
Accuracy (%)
Recall (%)
Precision (%)
F1-Score (%)
NSL-KDD
CNN
77.62
78.23
74.35
75.68
CNN-LSTM
80.52
81.42
79.43
78.42
BiLSTM
91.05
92.37
91.52
90.44
CDETKPCA-CNN-BiLSTM
97.97
97.23
95.89
96.47
Experimental results of overall indicators based on NSL-KDD.
Bar chart comparing four machine learning models—CNN, CNN-LSTM, BiLSTM, and CDETKPCA-CNN-BiLSTM—across accuracy, recall, precision, and F1-score. CDETKPCA-CNN-BiLSTM shows the highest values for all metrics, while CNN has the lowest.
We conduct experiments on NSL-KDD and systematically compare the fault diagnosis performance of four models, they are CNN, CNN-LSTM, BiLSTM and CDETKPCA-CNN-BiLSTM. From the data in Table 3, the accuracy of CNN is 77.62%, which has certain limitations in identifying faults. BiLSTM, with its bidirectional learning ability, achieves an accuracy of 91.05% and precision of 91.52%, demonstrating its outstanding performance in capturing complex fault patterns. The deep learning model with CDETKPCA-CNN-BiLSTM fusion attention mechanism has the best performance, with an accuracy of 97.97%. Recall, precision and F1-score are all leading, indicating that the deep learning model with CDETKPCA-CNN-BiLSTM fusion attention mechanism significantly enhances the diagnostic ability of business management system faults through multi technology fusion. This can identify faults more accurately and comprehensively, effectively reducing the probability of missed diagnosis and misdiagnosis.
From the accuracy shown in Figure 5, CNN only achieves an accuracy of 77.62%, while CNN-LSTM achieves 80.52%, which is about 3.74% higher than CNN, reflecting the enhancement of fault diagnosis ability by the fusion of convolution and cyclic structures. With the advantage of bidirectional information processing, BiLSTM further increases the accuracy to 91.05%, which is 13.08% higher than CNN-LSTM. The deep learning model with CDETKPCA-CNN-BiLSTM fusion attention mechanism achieves an accuracy of 97.97%, fully demonstrating the advantages of multi technology fusion architecture in fault diagnosis. The recall of the deep learning model with CDETKPCA-CNN-BiLSTM fusion attention mechanism is 97.23%, which is an improvement of 5.26% compared to BiLSTM. In terms of precision, CDETKPCA-CNN-BiLSTM ultimately achieves 95.89%. The F1-score shows that the deep learning model with CDETKPCA-CNN-BiLSTM fusion attention mechanism achieves optimal F1-score of 96.47%. The experimental data fully proves that the deep learning model of CDETKPCA-CNN-BiLSTM fusion attention mechanism is significantly better than other models in various key indicators. It can achieve more accurate fault diagnosis of business management system. Under the same network architecture, system fault diagnosis analysis and detection are carried out based on CIC-IDS2017. The experimental data results are displayed in Table 4 and visually presented in Figure 6.
Comparison of overall evaluation indicators of various models in CIC-IDS2017.
Dataset
Model
Accuracy (%)
Recall (%)
Precision (%)
F1-Score (%)
CIC-IDS2017
CNN
75.82
77.95
76.33
75.31
CNN-LSTM
80.65
78.42
81.23
82.18
BiLSTM
91.97
92.05
88.97
89.96
CDETKPCA-CNN-BiLSTM
96.81
98.70
97.9
97.49
Experimental results of overall indicators based on CIC-IDS2017.
Bar chart comparing machine learning models CNN, CNN-LSTM, BiLSTM, and CDETKPCA-CNN-BiLSTM using metrics accuracy, recall, precision, and F1-score. CDETKPCA-CNN-BiLSTM achieves the highest scores across all metrics, followed by BiLSTM, CNN-LSTM, and CNN.
The experimental results show that the fault diagnosis accuracy of CNN is 75.82%, while recall, precision and F1-score are 77.95%, 76.33% and 75.31%, respectively, indicating that it has certain limitations in identifying complex fault features. CNN-LSTM achieves an accuracy of 80.65% by integrating convolutional and recurrent structures, making it more advantageous in temporal feature processing. With its bidirectional information processing capability, BiLSTM improves its accuracy to 91.97% and performs even better in capturing fault features. The accuracy of CDETKPCA-CNN-BiLSTM fusion attention mechanism deep learning model is as high as 96.81%. This model achieves high dimensional feature fusion through CDET and KPCA methods, combines CNN, BiLSTM and attention mechanisms to more comprehensively and accurately extract fault features. This effectively distinguishes different fault modes and improves the reliability of fault diagnosis in the business management system.
From Figure 6, the CNN-LSTM achieves an accuracy of 80.65% by combining convolution and loop structures, which is a 6.37% increase compared to CNN. F1-score also improves by 9.12%, preliminarily demonstrating the optimization effect of fusion structure on fault diagnosis performance. BiLSTM, with its bidirectional information processing capability, achieves an accuracy of 91.97%. It has more advantages in capturing fault features in sequence data. The performance of the deep learning model with CDETKPCA-CNN-BiLSTM fusion attention mechanism is particularly outstanding, with an accuracy of 96.81%, an F1-score of 97.49%, an improvement of 8.37% compared to BiLSTM. This fully demonstrates that the combination of CDET and KPCA feature fusion technology and attention mechanism exhibits significant advantages in multi dimensional feature optimization and key information focusing, indicating that through feature fusion and deep network architecture. It effectively enhances the accurate identification ability of faults in business management system.
Overall, compared to LSTM, BiLSTM can improve the accuracy of fault diagnosis for time series data. The BiLSTM layer is more effective because it stacks forward and backward LSTM layers to fully utilize the data and better extract fault features from the data. At the same time, it is clear that the attention mechanism layer elevates the neural network’s ability to diagnose faults to a certain extent. Because it assigns higher attention to important fault feature quantities in the diagnosis process, allowing the model to better focus on feature quantities that have a greater impact on the diagnosis results.
Results of ablation experiment
In the case of using the same network architecture, this paper conducts experimental analysis on the ablation of fault risks in system network data. Based on CIC-IDS2017, the overall evaluation index comparison results of the ablation experiment are displayed in Table 5, the results are presented in Figure 7.
Comparison of ablation experiment results.
Dataset
Label
CDETKPCA
BiLSTM
Attention
Accuracy (%)
F1-Score (%)
CIC-IDS2017
a
✓
×
×
80.57
77.63
b
✓
✓
×
83.71
79.34
c
✓
×
✓
88.94
82.91
d
×
✓
✓
93.45
88.20
e
✓
✓
✓
96.73
94.96
Comparison of ablation experiment.
Line chart showing accuracy values increasing from approximately 80 to 97 on the y-axis across categories labeled a to e on the x-axis, with a red line representing accuracy.
It can be seen that the difference in accuracy between the ablation experiment and the model comparison experiment is due to the different core objectives and data scenarios of the two experiments. The model comparison experiment focuses on cross model comparison experiments, therefore NSL-KDD and CIC-IDS2017 are used. The core objective of the ablation experiment is to validate the key components of the model using only the CIC-IDS2017. The accuracy rate is 96.73%, which is slightly lower than the 96.81% of the same dataset mentioned above. This slight difference is due to parameter tuning made to contribute to the isolation component. For example, small adjustments are made to parameters such as batch size and learning rate, resulting in slight differences in accuracy.
From Table 5, the accuracy rate is 80.57% when using only CDETKPCA, indicating its feature fusion effect but lacking temporal modeling and key feature focusing. After adding BiLSTM, the accuracy rate increased by 3.14% compared to label a, reaching 83.71%. This indicates that BiLSTM is effective in bidirectional temporal modeling, but the lack of attention limits the improvement. When combining CDETKPCA with attention mechanism to remove BiLSTM, the accuracy is 88.94%, which is 8.37% higher than label a, highlighting the value of attention mechanism in focusing on key features. When using only BiLSTM and attention mechanism without CDETKPCA, the accuracy is 93.45%, an improvement of 12.88% compared to label a, indicating the potential of deep learning networks but the impact of feature redundancy on performance. The F1-Score of label e is the highest at 94.96%. This verifies the synergistic effect of CDETKPCA feature optimization, BiLSTM temporal modeling and attention mechanism focusing on key features, reveals the effectiveness of CDETKPCA-CNN-BiLSTM fusion attention mechanism deep learning model. Overall, after passing through three layers of convolutional neural networks, it can be seen that although convolutional neural networks have the ability to extract fault data features, their ability to extract temporal data is very limited. After passing through BiLSTM, it can be found that BiLSTM further extracts the features of the fault data. Finally, after being aggregated and converged through the attention mechanism layer, the diagnosis and classification of fault features can be effectively achieved.
Conclusion
This study focuses on the complexity of fault diagnosis in business management system and the limitations of traditional methods, constructs a deep learning based diagnostic system. This paper proposes a CDETKPCA-CNN-BiLSTM fault diagnosis network model that integrates attention mechanism. This method utilizes the characteristics of BiLSTM and attention mechanism to better extract fault features and classify them, demonstrating the fault classification ability of deep learning networks. We extract features from business management system data, fault features from both time and frequency domains and then fuse high dimensional features using CDET and KPCA to construct a fused feature dataset for business management system. The experimental results show that the features extracted by this method exhibit more efficient performance in distinguishing the types of faults in business management system, accurately distinguishing different fault modes. It significantly contributes to advancing system fault diagnosis and enhancing safety standards.
Data availability statement
The original contributions presented in the study are included in the article/supplementary material, further inquiries can be directed to the corresponding author.
Author contributions
ML: Validation, Investigation, Conceptualization, Project administration, Visualization, Formal Analysis, Resources, Writing – original draft. ZW: Writing – review and editing, Supervision, Methodology, Data curation, Software.
Conflict of interest
Author ZW was employed by Google Inc.
The remaining author(s) declared that this work was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.
Generative AI statement
The author(s) declared that generative AI was not used in the creation of this manuscript.
Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.
Publisher’s note
All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.
ReferencesGaoZCecatiCDingSX. A survey of fault diagnosis and fault-tolerant techniques—Part I: fault diagnosis with model-based and signal-based approaches. IEEE Transactions Industrial Electronics (2015) 62(6):3757–67. 10.1109/tie.2015.2417501BaiZMiaoHMiaoJXiaoNSunX. Artificial intelligence-driven cybersecurity applications and challenges. Innovative Appl AI (2025) 2(2):26–33. 10.70695/AA1202502A09WuKLiJZhangB. Abnormal detection of wireless power terminals in untrusted environment based on double hidden markov model. IEEE Access (2020) 9:18682–91. 10.1109/access.2020.3040856ChiYDongYWangZJYuFRLeungVCM. Knowledge-based fault diagnosis in industrial internet of things: a survey. IEEE Internet Things J (2022) 9(15):12886–900. 10.1109/jiot.2022.3163606ManzeyDGérardNWiczorekR. Decision-making and response strategies in interaction with alarms: the impact of alarm reliability, availability of alarm validity information and workload. Ergonomics (2014) 57(12):1833–55. 10.1080/00140139.2014.95773225224606MiaoJNingXHongSWangLLiuB. Secure and efficient authentication protocol for supply chain systems in artificial intelligence-based internet of things. IEEE Internet Things J (2025) 12(19):39532–42. 10.1109/jiot.2025.3592401GuoSLiXZhuPMuZ. ADS-detector: an attention-based dual stream adversarial example detection method. Knowledge-Based Syst (2023) 265(1):110388. 10.1016/j.knosys.2023.110388ChenJRenCHuYZhangYLuYLiQ. Dual-centralized Q-Network-Based reinforcement learning for cooperative path planning of multiple UAVs. IEEE Trans Intell Transportation Syst (2025) 26(9):13232–246. 10.1109/TITS.2025.3587392WeiTLiHMiaoJ. Integration and development path of smart grid technology: technology-driven, policy framework and application challenges. Processes (2025) 13(8):2428. 10.3390/pr13082428YaoGLeiTZhongJ. A review of convolutional-neural-network-based action recognition. Pattern Recognition Lett (2019) 118:14–22. 10.1016/j.patrec.2018.05.018MienyeIDSwartTGObaidoG. Recurrent neural networks: a comprehensive review of architectures, variants, and applications. Information (2024) 15.9:517. 10.3390/info15090517ZhaoWXuMChengXZhaoZ. An insulator in transmission lines recognition and fault detection model based on improved faster RCNN. IEEE Trans Instrumentation Meas (2021) 70:1–8. 10.1109/tim.2021.3112227BoubakerSKamelSGhazouaniNMellitA. Assessment of machine and deep learning approaches for fault diagnosis in photovoltaic system using infrared thermography. Remote Sensing (2023) 15(6):1686. 10.3390/rs15061686SuHXiangLHuA. Application of deep learning to fault diagnosis of rotating machineries. Meas Sci Technology (2024) 35(4):042003. 10.1088/1361-6501/ad1e20PiedadEJrChenYTChangHCKuoCC. Frequency occurrence plot-based convolutional neural network for motor fault diagnosis. Electronics (2020) 9.10:1711. 10.3390/electronics9101711DibajAEttefaghMMHassannejadREhghaghiMB. A hybrid fine-tuned VMD and CNN scheme for untrained compound fault diagnosis of rotating machinery with unequal-severity faults. Expert System Appl (2021) 167:114094. 10.1016/j.eswa.2020.114094ChenZMauricioALiWGrylliasK. A deep learning method for bearing fault diagnosis based on cyclic spectral coherence and convolutional neural networks. Mech System Signal Process (2020) 140:106683. 10.1016/j.ymssp.2020.106683HuangTZhangQTangXZhaoSLuX. A novel fault diagnosis method based on CNN and LSTM and its application in fault diagnosis for complex system. Artif Intelligence Rev (2022) 55(2):1289–315. 10.1007/s10462-021-09993-zHoangDTKangHJ. A motor current signal-based bearing fault diagnosis using deep learning and information fusion. IEEE Trans Instrumentation Meas (2019) 69(6):3325–33. 10.1109/tim.2019.2933119ZhangMZhangXMoJXiangZZhengP. Brake uneven wear of high-speed train intelligent monitoring using an ensemble model based on multi-sensor feature fusion and deep learning. Eng Fail Anal (2022) 137:106219. 10.1016/j.engfailanal.2022.106219HuangDLiSQinNZhangY. Fault diagnosis of high-speed train bogie based on the improved-CEEMDAN and 1-D CNN algorithms. IEEE Trans Instrumentation Meas (2021) 70:1–11. 10.1109/tim.2020.3047922ZhangLZhangHCaiG. The multiclass fault diagnosis of wind turbine bearing based on multisource signal fusion and deep learning generative model. IEEE Trans Instrumentation Meas (2022) 71:1–12. 10.1109/tim.2022.3178483DongHChenFWangZJiaLQinYManJ. An adaptive multisensor fault diagnosis method for high-speed train traction converters. IEEE Trans Power Electronics (2020) 36(6):6288–302. 10.1109/tpel.2020.3034190ZhuDLuSWangMLinJWangZ. Efficient precision-adjustable architecture for softmax function in deep learning. IEEE Trans Circuits System Express Briefs 67 (2020) 12:3382–6. 10.1109/tcsii.2020.3002564AlamTMAwanMJ. Domain analysis of information extraction techniques. Int J Multidiscip Sci Eng (2018) 9:6.LinW-CTsaiC-FZhongJR. Deep learning for missing value imputation of continuous data and the effect of data discretization. Knowledge-Based System (2022) 239:108079. 10.1016/j.knosys.2021.108079PukhovaVGorelovaEFerriniGBurnashevaS. Time-frequency representation of signals by wavelet transform. In: 2017 IEEE conference of Russian young researchers in electrical and electronic engineering (EIConRus). IEEE (2017) 715–18.XuHKouQFengN. Fiber optic vibration signal recognition based on IMFCC and CDET (July 2024). IEEE Sensors J (2024) 24(19):30490–99. 10.1109/JSEN.2024.3441105NguyenVHGolinvalJ-C. Fault detection based on kernel principal component analysis. Eng Structures (2010) 32(11):3683–91. 10.1016/j.engstruct.2010.08.012NaiduGZuvaTSibandaEM. A review of evaluation metrics in machine learning algorithms. In: Computer science on-line conference. Cham: Springer International Publishing (2023).YacoubyRAxmanD. Probabilistic extension of precision, recall, and F1-score for more thorough evaluation of classification models. In: Proceedings of the first workshop on evaluation and comparison of NLP system (2020).RosayAChevalECarlierFLerouxP.Network intrusion detection: a comprehensive analysis of CIC-IDS2017. In: 8th international conference on information system security and privacy. : SCITEPRESS-Science and Technology Publications (2022) 25–36.RavipatiRDAbualkibashM. Intrusion detection system classification using different machine learning algorithms on KDD-99 and NSL-KDD datasets-a review paper. Int J Computer Sci and Inf Technology (Ijcsit) (2019) 11(3):65–80. 10.5121/ijcsit.2019.11306AlzubaidiLZhangJHumaidiAJAl-DujailiADuanYAl-ShammaOReview of deep learning: concepts, CNN architectures, challenges, applications, future directions. J Big Data (2021) 8:1–74. 10.1186/s40537-021-00444-833816053KimT-YChoS-B. Predicting residential energy consumption using CNN-LSTM neural networks. Energy (2019) 182:72–81. 10.1016/j.energy.2019.05.230HameedZGarcia-ZapirainB. Sentiment classification using a single-layered BiLSTM model. Ieee Access (2020) 8:73992–4001. 10.1109/access.2020.2988550
Edited by:Kanak Kalita, Vel Tech Dr. RR and Dr. SR Technical University, India
Reviewed by:S. J. Ma, North Minzu University, China
Jinlei Wu, Zhengzhou Research Institute of Harbin Institute of Technology, China