Time series unsupervised anomaly detection method based on conditional regularization flow model

Abstract

The invention discloses a time series unsupervised anomaly detection method based on a conditional regularization flow model. The time series unsupervised anomaly detection method comprises the following steps of: (1) preprocessing a time series, and constructing a training data set; (2) constructing a recurrent neural network for processing a historical time series into implicit representation; (3) constructing the conditional regularization flow model for modeling probability density of an observation window by taking a historical observation series as a condition, wherein the conditional regularization flow model is used for calculating conditional logarithm likelihood of a time series in the observation window; (4) learning optimization model parameters based on a maximum likelihood principle; (5) selecting a threshold value according to the conditional logarithm likelihood of all the samples under the conditional regularization flow model with determined parameters; (6) and calculating the conditional logarithm likelihood of the time series in the observation window on line by using the recurrent neural network and the conditional regularization flow model with the determinedparameters, and reporting the observation window to be abnormal when the conditional logarithm likelihood is lower than a specified threshold value. The time series unsupervised anomaly detection method can effectively reduce the false alarm rate of anomaly detection.

Description

technical field

[0001] The invention relates to the field of time series anomaly detection, in particular to a time series unsupervised anomaly detection method based on a conditional normalized flow model. Background technique

[0002] Time-series data widely exists in the fields of commerce, finance, smart cities, medical care, and environmental science. Time-series anomaly detection refers to the technology of judging whether the underlying system is in an abnormal state based on time-series observations. It can play an important role in applications such as network security, disease detection, and industrial control.

[0003] A simple way to perform unsupervised anomaly detection on time series is to ignore or weaken its time series nature, treat it as a collection of unordered data points, and use general unsupervised anomaly detection algorithms to judge whether the data points are abnormal. For example, the observation at each moment can be simply regarded as a scala...

Images