An Unsupervised Anomaly Detection Method for Time Series Based on Conditional Regularized Flow Model

Abstract

The invention discloses a time series unsupervised anomaly detection method based on a conditional normalized flow model, including: (1) preprocessing the time series to construct a training data set; (2) constructing a recurrent neural network for The historical time series is treated as an implicit representation; (3) Construct a conditional regularized flow model that takes the historical observation sequence as the condition and models the probability density of the observation window, and is used to calculate the conditional logarithmic likelihood of the time series in the observation window; ( 4) Learning and optimizing model parameters based on the maximum likelihood principle; (5) Selecting the threshold value according to the conditional logarithmic likelihood of all samples under the conditional regularized flow model determined by parameters; (6) Using the cyclic neural network determined by parameters and The conditional regularized flow model calculates the conditional log-likelihood of the time series in the observation window online, and when the conditional log-likelihood is lower than the specified threshold, the observation window is reported as abnormal. This detection method can effectively reduce the false positive rate of anomaly detection.

Description

technical field [0001] The invention relates to the field of time series anomaly detection, in particular to a time series unsupervised anomaly detection method based on a conditional normalized flow model. Background technique [0002] Time-series data widely exists in the fields of commerce, finance, smart cities, medical care, and environmental science. Time-series anomaly detection refers to the technology of judging whether the underlying system is in an abnormal state based on time-series observations. It can play an important role in applications such as network security, disease detection, and industrial control. [0003] A simple way to perform unsupervised anomaly detection on time series is to ignore or weaken its time series nature, treat it as a collection of unordered data points, and use general unsupervised anomaly detection algorithms to judge whether the data points are abnormal. For example, the observation at each moment can be simply regarded as a scala...

AI Technical Summary

Problems solved by technology

First of all, due to the interference of external noise, the influence of internal uncertainty and the limitation of the prediction model ability, when the time series cannot be effectively predicted, the anomaly discrimination based on the single time point forecast error is usually not robust enough, and the false positive rate is high

Secondly, although the uncertainty is considered in the abnormal discrimination based on the confidence interval, it only provides the upper and lower confidence bounds of the possible values ​​of the time points to be detected, and the distribution of the possible values ​​of the time points to be detected in real time series data is usually more complicated. , it is difficult to be effectively summarized by the upper and lower bounds, and it is prone to false negatives

Images