Time sequence anomaly detection method and device, equipment and storage medium

Abstract

The invention discloses a time sequence anomaly detection method, device and equipment and a storage medium, and the method comprises the steps: initializing a system, taking an original time sequence T as input, and initializing TL and Ts to be null; performing assignment through TL <-T-Ts, using a gradient descent method through an objective function # imgabs0 #, and optimizing parameters theta of an encoder and a single classification method; fixing the optimized parameter theta, starting to optimize the separated abnormal value part Ts, and reducing Ts1 through a near-end approximation sparse function; and judging whether the steps S1 to S3 are continuously and repeatedly executed or not by calculating whether circulation stop conditions, namely TL and Ts, are changed or not, and finally returning to a clean time sequence obtained by separation. The method can be applied to multiple fields, the influence of abnormal values can be effectively processed, and the time sequence abnormity can be detected more accurately.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence and relates to anomaly detection and model robustness technology. Background Art

[0002] Time series anomaly detection (AD) is an important research direction in the field of artificial intelligence. It is widely used in monitoring and security applications in various industries and has become a research hotspot in the field of deep learning.

[0003] Time series outlier detection is a fundamental problem in data mining and has been applied to many applications. Time series anomaly detection also plays an important role in health monitoring, fraud detection and other applications, which means picking out different time series samples from the majority. In practice, due to the training samples in reality, it is impossible to guarantee that all time series are clean and free of anomalies, which may lead to the problem that the model is insensitive to anomalies.

[0004] The following prior art relates to this.

[0005] Chinese invention patent document CN118691931A discloses a multivariate time series anomaly detection method and system based on multi-subgraph fusion, which aims to improve the model's ability to detect anomalies through denoising and feature extraction, as well as the fusion method of graph neural network and Transformer encoder. This method can solve the problem of the model's insensitivity to anomalies to a certain extent, because it captures dynamic changes and local patterns in time series through multi-subgraph fusion, thereby improving the robustness of anomaly detection.

[0006] In addition, Chinese invention patent document CN118094443A discloses a time series anomaly detection method and system based on differential multi-resolution decomposition, which uses fast Fourier transform to perform periodic analysis and multi-resolution decomposition network to separate different periodic components. This method can effectively handle complex periodic dependencies and short-term dependencies in time series. However, it mainly focuses on the decomposition and anomaly detection of periodic components, and may not be sensitive enough to non-periodic anomalies, so it may not completely solve the problem of the model's insensitivity to anomalies.

[0007] Chinese invention patent document CN117556311A discloses an unsupervised time series anomaly detection method based on multidimensional feature fusion, which captures complex characteristics such as long-term dependence and periodicity in time series through multidimensional feature fusion. This method can improve the model's sensitivity to anomalies to a certain extent, because it learns the normal pattern of the time series through self-supervised training and outputs samples that deviate significantly from the normal pattern as abnormal data. However, if the proportion of abnormal data in the training sample is low, the model may still find it difficult to learn the characteristics of the anomaly.

[0008] The above existing technologies can solve the problem of the model's insensitivity to anomalies to a certain extent, especially in improving the model's ability to capture complex patterns in time series and the robustness of anomaly detection.

[0009] However, if the proportion of abnormal data in the training samples is low or the difference between abnormal patterns and normal patterns is not obvious, these methods may still fail to ensure the model's high sensitivity to anomalies. In addition, the effectiveness of these methods also depends on the adjustment and optimization of model parameters and their adaptability to specific data sets. Summary of the invention

[0010] The purpose of the present invention is to provide a time series anomaly detection method, device and storage medium, which aims to improve the robustness of the model during anomaly detection by separating the outliers in the original time series, so that the model can more comprehensively learn the overall normality characteristics of the time series samples in the training set during the training phase, thereby being able to more accurately and efficiently identify anomalies in time series anomaly detection.

[0011] The scheme of the present invention is as follows: According to a first main aspect of the present invention, a time series anomaly detection method is provided, the method comprising the following steps: S1, system initialization, the original time series T As input, and initialize T L and T s is empty; T L represents a clean time series, T s Represents the abnormal part of the time series; S2, by T L ← TT s Assign values ​​and pass the objective function Use gradient descent to optimize the parameters of the encoder and the single-class method simultaneously i , l 1 and l 2 is the weight coefficient; S3, the optimized parameters i Fixed, started optimizing the separated outlier part T s , by reducing ||T through the sparse function of the proximal approximation s ||1, making the separated part closer to the anomaly; S4, by calculating the loop stop condition, that is T L and T s If there is any change, it is determined whether to continue to repeatedly execute steps S1 to S3, and finally return the separated clean time series.

[0012] For a given N time series training set samples, the objective function consists of two parts, namely learning the characteristics of the time series from the perspective of the autoencoder and the OC method, respectively. l 1 and l 2 respectively control the weight of the two, is the reconstruction error of seq2seq, which is specifically defined as: ; The reconstructed time series is ; oc error It is defined by calculating the distance between the data point q and the center point c: ; The data point q is obtained by projecting the potential representation information of the training sample in the encoder into the high-dimensional feature space, and c is the center point obtained by the Gaussian mixture model; q i Represents that the i-th time series sample is mapped to a high-dimensional data point; in and They represent the decoder and encoder parts of the autoencoder respectively.

[0013] As a further preferred solution, for the input time series T Whether it is classified as an anomaly is determined by the anomaly score S: ; ; in is a predefined classification threshold.

[0014] As a further preferred solution, outlier separation is to separate the original matrix into a low-rank matrix by RPCA method.L and the matrix consisting of abnormal elements S , where the low-rank matrix L It is used to represent the clean part of the original matrix, and its objective function is as follows: .

[0015] As a further preferred solution, in step S3, the abnormal part in the input time series is separated, and only the normal features in the sample are learned. The objective function is as follows: .

[0016] As a further preferred solution, the objective function is optimized by The norm is converted to Norm, the formula is as follows: .

[0017] Based on the second main aspect of the present invention, a time series anomaly detection device is provided, comprising at least one of the following modules or a combination thereof: Initialization module, used to convert the original time series T As input, and initialize T L and T s is empty; Parameter optimization module, used to T L ← TT s Assign values ​​and pass the objective function Use gradient descent to optimize the parameters of the encoder and the single-class method simultaneously i Outlier optimization module, used to optimize the parameters after i After fixing, ||T is reduced by the sparse function of the proximal approximation s ||1; The loop judgment module is used to judge whether to continue to repeatedly execute the operations of the initialization module, the parameter optimization module and the outlier optimization module, and finally return the separated clean time series.

[0018] For a given N time series training set samples, the objective function consists of two parts, namely learning the characteristics of the time series from the perspective of the autoencoder and the OC method, respectively. l 1 and l 2 respectively control the weight of the two, is the reconstruction error of seq2seq, which is specifically defined as: ; The reconstructed time series is ; oc error It is defined by calculating the distance between the data point q and the center point c: ; The data point q is obtained by projecting the potential representation information of the training sample in the encoder into the high-dimensional feature space, and c is the center point obtained by the Gaussian mixture model; q i Represents that the i-th time series sample is mapped to a high-dimensional data point; in and They represent the decoder and encoder parts of the autoencoder respectively.

[0019] Based on the third main aspect of the present invention, an electronic device is provided, comprising: at least one processor; a memory communicatively connected to the at least one processor; the memory storing a computer program which, when executed by the at least one processor, enables the at least one processor to implement the aforementioned time series anomaly detection method.

[0020] According to a fourth main aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed, the aforementioned time series anomaly detection method is implemented.

[0021] Advantages and beneficial effects of the present invention: This paper proposes a new time series anomaly detection method, the core of which lies in the unique model construction and optimization method. By combining the autoencoder (AE) and the single classification method, the objective function At the same time, from the perspective of the reconstruction error of the autoencoder and the feature learning of the OC method, a comprehensive learning of time series features is achieved.

[0022] During the optimization process, not only the parameters of the encoder and the single classification method i Perform gradient descent optimization and also target the outlier part T s Through the optimization of the sparse function of proximal approximation, it is constrained to a smaller hypersphere, similar to the single classification method, which effectively improves the model's ability to handle outliers and reduces the impact of outliers on the overall model. This is an outstanding substantive feature of the present invention in model construction and optimization. Compared with traditional methods, it can identify anomalies more accurately and has significant progress.

[0023] In this invention, the abnormal part of the original time series is separated by imitating the RPCA method, so that the model can focus on learning the characteristics of normal samples.T L Represents the changing trend and periodic information in the time series data, while the abnormal part T s The model contains unexplainable random fluctuations that are out of the rules. By optimizing the objective function, the interference of outliers is eliminated when learning the characteristics of normal samples, thus enhancing the robustness of the model.

[0024] In practical applications, this method can effectively deal with abnormal data that may exist in training samples, so that the model can still accurately learn normal characteristics when facing complex time series data, thereby more reliably detecting anomalies. This is a significant innovation and progress in dealing with outliers.

[0025] The design of the objective function takes into account multiple key factors. On the one hand, the reconstruction error of seq2seq Make the model reconstruction result close to the original input, ensuring accurate reconstruction of normal samples; on the other hand, the OC error By calculating the distance between the data point and the center point, the size of the hypersphere is optimized to better handle noise and outliers. l 1 and l 2. Control the weights of the two parts to achieve a balance between the two. In addition, in the objective function of the outlier separation part, the reconstruction error, OC error and outlier norm are combined to further optimize the outlier separation effect.

[0026] The present invention provides a complete time series anomaly detection method flow, from system initialization to parameter optimization, outlier separation, and then to cyclic judgment until a clean time series is returned. Each step is closely connected and the logic is clear.

[0027] The complete process design of the present invention ensures the feasibility and stability of the method, and is applicable to a variety of fields such as health monitoring, fraud detection, etc. In different fields, this method can effectively handle abnormal situations in time series data, provide strong support for monitoring and security applications in various industries, and show a wide range of application potential, which is also its outstanding advantage and significant progress compared with other methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It shows a time series containing anomalies in a training set in one embodiment of the present invention; Figure 2 It shows that similar anomalies appear in the time series in the test set in one embodiment of the present invention, which will cause the model to be unable to recognize these similar anomalies; Figure 3 The specific training process of the model in one embodiment of the present invention is shown, which includes two parts, namely, an integrated detection part and a model robustness part for separating abnormalities. DETAILED DESCRIPTION

[0029] The preferred embodiments of the present invention will be described in detail below so that the purpose, features and advantages of the present invention can be more clearly understood. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are only intended to illustrate the essential spirit of the technical solution of the present invention.

[0030] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the relevant art will recognize that the embodiments may be practiced without one or more of these specific details. In other cases, well-known techniques associated with the present application may not be shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0031] References throughout the specification to "one embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of "in one embodiment" or "in an embodiment" in various places throughout the specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any manner in one or more embodiments.

[0032] First, Figure 1 As shown, the present invention provides a safe and efficient time series anomaly detection method, the specific steps are as follows: The deep OC method proposed in this invention combines two assumptions, namely that normal samples can be better reconstructed, and when mapped to high-dimensional space, a hypersphere with a smaller radius is constructed, so that the features of clean samples can be learned more comprehensively. The motivation for this is that under a single assumption, the normality features learned by the model may be one-sided, resulting in the fact that during anomaly detection, some features of abnormal samples are different from those of normal samples, but these features are not recognized by the model, resulting in certain anomalies in specific situations that cannot be detected by the model under a single assumption.

[0033] S1, system initialization, the original time series T As input, and initialize T L and T s is empty; T L represents a clean time series, T s Represents the abnormal part of the time series.

[0034] S2, by T L ← TT sAssign values ​​and pass the objective function Use gradient descent to optimize the parameters of the encoder and the single-class method simultaneously i ,in, l 1 and l 2 is the weight coefficient; For a given N time series training set samples, the objective function consists of two parts, namely learning the characteristics of the time series from the perspective of the autoencoder and the OC method, respectively. l 1 and l 2 respectively control the weight of the two, is the reconstruction error of seq2seq, which is specifically defined as: ; The reconstructed time series is

[0035] Mainly by calculating the mean square error between the original sequence and the reconstructed sequence, the reconstruction result of the model is made as close to the original input as possible. Defined as oc error: ; N In the time series training set samples, data point q is obtained by projecting the potential representation information of the training sample in the encoder into the high-dimensional feature space, and then calculating the distance between q and the center point c, minimizing the size of the hypersphere with c as the center and q as the radius, where the center point is obtained by the Gaussian mixture model. The Gaussian model can model complex data distribution and better handle noise and outliers: ; in is a weight function based on Gaussian distribution, specifically: ; in is the standard deviation of the Gaussian distribution, controls the degree of fuzziness, and for the test phase, whether the time series T is classified as abnormal is determined by the anomaly score S Decide: ; ; in is a predefined classification threshold.

[0036] S3, for a given matrix M in PCA, a low-rank matrix can be identified to approximate the replacement matrix M. Since SVD is also used in PCA to identify low-rank matrices, PCA also has the problem of being sensitive to outliers in SVD.

[0037] In order to improve its robustness to outliers, the present invention proposes an RPCA method, which aims to separate the original matrix into a low-rank matrix L for representing the clean part of the original matrix and a matrix S composed of abnormal elements. Its objective function is as follows: ; Following the RPCA approach, the abnormal part of the input time series can be separated and only the normal features in the sample can be learned. T L Represents the changing trend and periodic information in time series data. T s The abnormal features mainly include the unexplainable random fluctuations that deviate from the rules in the time series. By eliminating the influence of this part on the hidden representation, the information of clean samples can be learned more accurately and better distinguished from abnormal samples. The objective function is as follows: ; The loss functions in the above formulas all contain a The term of the norm is used to optimize the sparsity of outliers while ensuring the semantics of outliers. However The norm is non-convex, which makes optimization difficult.

[0038] Will Convert to norm, which can be well approximated The norm formula is as follows .

[0039] S4, by calculating the loop stop condition, that is T L and T s If there is any change, it is determined whether to continue to repeatedly execute steps S1 to S3, and finally return the separated clean time series.

[0040] The matters not described in detail in the present invention are all known technologies to those skilled in the art.

[0041] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A time series anomaly detection method, characterized in that: The method comprises the following steps: S1, system initialization, the original time series T As input, and initialize T L and T s is empty; T L represents a clean time series, T s Represents the abnormal part of the time series; S2, by T L ← TT s Assign values ​​and pass the objective function Use gradient descent to optimize the parameters of the encoder and the single-class method simultaneously θ , λ 1 and λ 2 is the weight coefficient; S3, the optimized parameters θ Fixed, started optimizing the separated outlier part T s , by reducing ||T through the sparse function of the proximal approximation s ||1, making the separated part closer to the anomaly; S4, by calculating the loop stop condition, that is T L and T s If there is any change, determine whether to continue to repeatedly execute steps S1 to S3, and finally return the separated clean time series; For a given N time series training set samples, the objective function consists of two parts, namely learning the characteristics of the time series from the perspective of the autoencoder and the OC method, respectively. λ 1 and λ 2 respectively control the weight of the two, is the reconstruction error of seq2seq, which is specifically defined as: ； The reconstructed time series is ; oc error It is defined by calculating the distance between the data point q and the center point c: ； The data point q is obtained by projecting the potential representation information of the training sample in the encoder into the high-dimensional feature space, and c is the center point obtained by the Gaussian mixture model; q i Represents that the i-th time series sample is mapped to a high-dimensional data point; in and They represent the decoder and encoder parts of the autoencoder respectively.

2. The time series anomaly detection method according to claim 1, characterized in that: For the input time series T Whether it is classified as an anomaly is determined by the anomaly score S: ； ； in is a predefined classification threshold.

3. The time series anomaly detection method according to claim 1, characterized in that: Outlier separation is to separate the original matrix into a low-rank matrix through the RPCA method. L and the matrix consisting of abnormal elements S , where the low-rank matrix L It is used to represent the clean part of the original matrix, and its objective function is as follows: 。 4. The time series anomaly detection method according to claim 3, characterized in that: In step S3, the abnormal part of the input time series is separated and only the normal features in the sample are learned. The objective function is as follows: 。 5. The time series anomaly detection method according to claim 4, characterized in that: The objective function is to replace The norm is converted to Norm, the formula is as follows: 。 6. A time series anomaly detection device, characterized in that: Include at least one or a combination of the following modules: Initialization module, used to convert the original time series T As input, and initialize T L and T s is empty; Parameter optimization module, used to T L ← TT s Assign values ​​and pass the objective function Use gradient descent to optimize the parameters of the encoder and the single-class method simultaneously θ Outlier optimization module, used to optimize the parameters after θ After fixing, ||T is reduced by the sparse function of the proximal approximation s ||1; The loop judgment module is used to judge whether to continue to repeatedly execute the operations of the initialization module, parameter optimization module and outlier optimization module, and finally return the separated clean time series; For a given N time series training set samples, the objective function consists of two parts, namely learning the characteristics of the time series from the perspective of the autoencoder and the OC method, respectively. λ 1 and λ 2 respectively control the weight of the two, is the reconstruction error of seq2seq, which is specifically defined as: ； The reconstructed time series is ; oc error It is defined by calculating the distance between the data point q and the center point c: ； The data point q is obtained by projecting the potential representation information of the training sample in the encoder into the high-dimensional feature space, and c is the center point obtained by the Gaussian mixture model; q i Represents that the i-th time series sample is mapped to a high-dimensional data point; in and They represent the decoder and encoder parts of the autoencoder respectively.

7. An electronic device, characterized in that: include: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores a computer program, which, when executed by the at least one processor, enables the at least one processor to implement the time series anomaly detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed, the time series anomaly detection method as described in any one of claims 1 to 5 is implemented.

Images