A semi-supervised time series anomaly detection method and system

Abstract

The present invention relates to a semi-supervised time series anomaly detection method and system, and constructs an autoencoder model based on a long-term short-term memory network. The autoencoder model includes an encoder, a normal flow data decoder and an abnormal flow data decoder. Select normal labeled traffic dataset and unlabeled traffic dataset in the traffic time series data set, and use two training sets to train the autoencoder model. There is no need to predefine a threshold in advance. For unlabeled data, by comparing two The size of the reconstruction error of each decoder can be used to judge whether it is abnormal. The present invention avoids the difficulty of selecting the optimal threshold, and can accurately detect anomalies. It also adopts a sliding window to perform enrichment processing of abnormal flow data on unmarked flow data sets, which solves the problem of rare abnormal points and enriches abnormal data. , further improving the anomaly detection rate.

Description

technical field [0001] The invention relates to the technical field of anomaly detection, in particular to a semi-supervised time series anomaly detection method and system. Background technique [0002] With the development of the technology era, the amount of data is growing explosively. Among these data, the proportion of time series data is very large. Among them, the most common type of time-series data is network traffic, which refers to the amount of data sent and received by people who visit online websites. Abnormal network traffic indicates abnormal changes in time-series traffic, and the abnormal data in it may cause serious Consequences, fast and accurate detection is crucial to the efficient operation of complex computer network systems. [0003] At present, there are certain defects in the traditional method, such as the method based on rules, the first step of this method is to obtain the rules, and the second step is to judge whether the behavior is similar ...

AI Technical Summary

Problems solved by technology

Generally, the reconstruction error can be obtained by calculating the reconstructed sample with the original sample, and then comparing the reconstruction error with a predefined threshold to judge whether the sample is an abnormal sample, but the optimal threshold is difficult to choose

Images