Time series unsupervised anomaly detection method based on conditional regularization flow model

Abstract

The invention discloses a time series unsupervised anomaly detection method based on a conditional regularization flow model. The time series unsupervised anomaly detection method comprises the following steps of: (1) preprocessing a time series, and constructing a training data set; (2) constructing a recurrent neural network for processing a historical time series into implicit representation; (3) constructing the conditional regularization flow model for modeling probability density of an observation window by taking a historical observation series as a condition, wherein the conditional regularization flow model is used for calculating conditional logarithm likelihood of a time series in the observation window; (4) learning optimization model parameters based on a maximum likelihood principle; (5) selecting a threshold value according to the conditional logarithm likelihood of all the samples under the conditional regularization flow model with determined parameters; (6) and calculating the conditional logarithm likelihood of the time series in the observation window on line by using the recurrent neural network and the conditional regularization flow model with the determinedparameters, and reporting the observation window to be abnormal when the conditional logarithm likelihood is lower than a specified threshold value. The time series unsupervised anomaly detection method can effectively reduce the false alarm rate of anomaly detection.

Description

technical field [0001] The invention relates to the field of time series anomaly detection, in particular to a time series unsupervised anomaly detection method based on a conditional normalized flow model. Background technique [0002] Time-series data widely exists in the fields of commerce, finance, smart cities, medical care, and environmental science. Time-series anomaly detection refers to the technology of judging whether the underlying system is in an abnormal state based on time-series observations. It can play an important role in applications such as network security, disease detection, and industrial control. [0003] A simple way to perform unsupervised anomaly detection on time series is to ignore or weaken its time series nature, treat it as a collection of unordered data points, and use general unsupervised anomaly detection algorithms to judge whether the data points are abnormal. For example, the observation at each moment can be simply regarded as a scala...

AI Technical Summary

Problems solved by technology

First of all, due to the interference of external noise, the influence of internal uncertainty and the limitation of the prediction model ability, when the time series cannot be effectively predicted, the anomaly discrimination based on the single time point forecast error is usually not robust enough, and the false positive rate is high

Secondly, although the uncertainty is considered in the abnormal discrimination based on the confidence interval, it only provides the upper and lower confidence bounds of the possible values ​​of the time points to be detected, and the distribution of the possible values ​​of the time points to be detected in real time series data is usually more complicated. , it is difficult to be effectively summarized by the upper and lower bounds, and it is prone to false negatives

Images