Construction method of time series data anomaly detection model, anomaly detection method and system

Abstract

The invention discloses a time series data anomaly detection model construction method and an anomaly detection method and system, and the method comprises the steps: reconstructing time series data through employing a model constructed based on a TCN-LSTM-CMA auto-encoder, and generating reconstructed data; calculating a reconstruction error by comparing the time sequence data and the reconstruction data before and after reconstruction; and according to the calculated reconstruction error, carrying out anomaly detection by adopting an isolated forest algorithm, and identifying abnormal data in the time series data. The invention provides a brand-new TCN-LSTM-CMA auto-encoder model construction method, and the method is combined with an isolated forest method to carry out time series data anomaly detection. According to the method, the defects of an existing anomaly detection method in the aspects of precision, adaptability and robustness are overcome. The method has a wide application prospect in the aspect of time series data anomaly detection in the fields of industrial monitoring, network security and the like.

Description

Technical Field

[0001] The present invention belongs to the field of big data / data processing, and in particular relates to a method for constructing a time series data anomaly detection model, an anomaly detection method and a system. Background Art

[0002] With the rapid development of the Internet of Things (IoT) and big data technology, massive amounts of time series data are generated, and the demand for processing these data has increased. Time series data has complex multidimensional characteristics and time dependence, and is widely used in many fields, such as industrial monitoring and network traffic analysis. Accurately detecting abnormal events in these data to ensure the stability and reliability of the system has become an important and urgent challenge to be solved.

[0003] Traditional anomaly detection methods usually rely on statistics and rule-based criteria, such as threshold-based detection methods and statistical models. These methods are often effective when processing simple time series data. However, as the complexity and dimensionality of time series data increase, the limitations of traditional methods become more and more obvious. For example, simple threshold methods are difficult to effectively capture the complex relationships in multivariate time series data, while statistical models face the problems of high computational complexity and insufficient generalization ability when processing high-dimensional data. In addition, these traditional methods usually rely on a large amount of prior knowledge and empirical rules, and face problems such as weak generalization ability and low accuracy.

[0004] In recent years, with the rise of deep learning technology, anomaly detection methods based on neural networks have gradually attracted attention. There are many studies in this area, such as the "A method for detecting anomalies in aircraft power supply system operation and maintenance data based on deep autoencoders" published with publication number CN118503879A, which uses an autoencoder model based on a bidirectional long short-term memory network (BiLSTM). Anomaly detection uses a fixed threshold method set manually. However, this detection method relies on manual labeling and has significant deficiencies in detection accuracy. Although the "A method and system for detecting and identifying bridge cracks based on unsupervised learning and big data" published with publication number CN118536072A reduces the reliance on artificial rules, it cannot effectively identify complex dependencies and key feature information in time series data, resulting in unsatisfactory detection accuracy. Summary of the invention

[0005] The present invention aims to solve one of the technical problems existing in the related art at least to a certain extent.

[0006] One object of the present invention is to provide a method for constructing a time series data anomaly detection model, which can effectively capture the long-term dependencies and complex feature relationships in the time series data with complex dependencies.

[0007] Another object of the present invention is to provide a method for detecting anomalies in time series data using an autoencoder constructed by the above-mentioned construction method.

[0008] Another object of the present invention is to provide a detection system that applies the above-mentioned time series data anomaly detection method.

[0009] Another object of the present invention is to provide a medium, an electronic device and a computer program product for executing the above-mentioned time series data anomaly detection method.

[0010] In order to achieve the above-mentioned purpose, the present invention provides a method for constructing a time series data anomaly detection model, comprising the following steps:

[0011] S1. Construct a data set generation module, which obtains time series data, preprocesses the time series data, and generates a data set;

[0012] S2. Construct an autoencoder module, which consists of an encoder and a decoder;

[0013] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0014] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

[0015] Preferably, the time series data is preprocessed in step S1, specifically including:

[0016] S11, normalizing the time series data input into the data set generation module, filling in missing values, and serializing in chronological order;

[0017] S12. Use the sliding window method to construct the data set.

[0018] Preferably, in step S2, the encoder adopts a TCN-LSTM-CMA framework, and the preprocessed data set first enters the temporal convolutional network of the encoder part, and the temporal convolutional network extracts useful feature sequences while maintaining the data structure;

[0019] The feature sequence output from the temporal convolutional network enters the long short-term memory network, which captures the deep temporal features in the sequence and enhances the ability to express implicit information in the data;

[0020] After encoding is completed, the feature sequence output by the long short-term memory network is combined with the causal masked self-attention mechanism to perform self-attention operations on the key points in the time series.

[0021] Preferably, in step S2, the decoder adopts an LSTM-TCN framework, and the feature sequence processed by the causal masking self-attention mechanism enters the long short-term memory network of the decoder part, and the long short-term memory network gradually restores the time dependency and structural information in the sequence;

[0022] The long short-term memory network passes the decoded data to the temporal convolutional network module of the decoder part for final feature reconstruction and output.

[0023] Another aspect of the present invention provides a time series data anomaly detection method, firstly using the time series data anomaly detection model constructed by the above construction method to reconstruct the time series data; and then continuing to perform the following steps:

[0024] S3, calculating the reconstruction error by comparing the time series data before and after reconstruction with the reconstructed data;

[0025] S4. Based on the calculated reconstruction error, the isolation forest algorithm is used to perform anomaly detection to identify abnormal data in the time series data.

[0026] Another aspect of the present invention provides a time series data anomaly detection system, comprising:

[0027] A time series data anomaly detection model building module is used to build a time series data anomaly detection model and reconstruct the time series data into reconstructed data similar to the time series data;

[0028] A reconstruction error acquisition module is used to calculate the reconstruction error by comparing the time series data before and after reconstruction with the reconstruction data;

[0029] The anomaly detection module is used to perform anomaly detection based on the calculated reconstruction error and use the isolation forest algorithm to identify abnormal data in the time series data.

[0030] Preferably, the time series data anomaly detection model building module includes:

[0031] A data set generation submodule is used to obtain time series data, and pre-process the time series data to generate a data set;

[0032] The autoencoder module submodule consists of two parts: encoder and decoder;

[0033] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0034] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

[0035] Another aspect of the present invention provides a non-transitory computer-readable storage medium having computer instructions stored thereon, the computer instructions enabling a computer to execute the above-mentioned time series data anomaly detection method.

[0036] Another aspect of the present invention provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the above-mentioned timing data anomaly detection method.

[0037] On the other hand, the present invention provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the above-mentioned time series data anomaly detection method.

[0038] Beneficial effects: The present invention uses a brand-new way to implement the autoencoder. Both the encoding module and the decoding module of the autoencoder adopt a brand-new architecture. Among them, TCN-LSTM-CMA is used as the encoder module. In the decoder part, the corresponding LSTM-TCN structure is adopted. The TCN-LSTM-CMA structure can effectively capture the long-term dependencies and complex feature relationships in time series data. TCN can extract features of different time scales through different convolutional layers, and enhance feature representation through dimensionality expansion, thereby improving the flexibility and diversity of the model. LSTM further enhances the modeling ability of long-term relationships in time series, and can capture global features and trends across time steps. The output obtained by this module is then processed by CMA, which can further enhance the model's attention to key time points and important features. CMA not only ensures that the model can only rely on past information for prediction and prevents the leakage of future information, but also effectively improves the model's sensitivity and reaction speed to abnormal changes in time series by dynamically adjusting the importance of each time step, thereby better learning the time series characteristics of the data and improving the accuracy and robustness of anomaly detection. This innovative architecture enables the model to not only perform well in processing conventional time series data, but also demonstrate higher accuracy and reliability in complex, multi-dimensional time series scenarios.

[0039] The present invention uses an improved autoencoder combined with an isolation forest method for anomaly detection. The task of the autoencoder is to extract and reconstruct the input time series data, capture the potential patterns and structures in the data, and reflect the degree of abnormality of the data through reconstruction errors. The task of the isolation forest is to use the reconstruction error generated by the autoencoder as input to detect abnormal points. Isolation forest can effectively identify potential abnormal data points by performing isolation analysis on the data. The combination of the two can achieve efficient and accurate anomaly detection in complex time series data. The autoencoder is responsible for feature extraction and reconstruction, and the isolation forest is responsible for the final anomaly identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Flow chart of the time series data anomaly detection method of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0042] Combine the following Figure 1 The present invention describes a method for constructing a time series data anomaly detection model, an anomaly detection method and a system.

[0043] The purpose of the present invention is to use a new TCN-LSTM-CMA autoencoder and combine it with isolation forest to perform time series data anomaly detection, so as to achieve efficient and accurate anomaly detection of complex time series data, thereby improving the stability and reliability of the system and solving the problems of low detection accuracy, poor adaptability, high computational complexity and manual dependence in the prior art when processing complex time series data. Specifically, the purposes of the present invention are as follows:

[0044] 1. Improve the accuracy of anomaly detection: It can accurately capture the long-term dependencies and key feature information in time series data, thereby achieving high-precision detection of abnormal events and reducing false positives and negatives.

[0045] 2. Enhance the adaptability and robustness of the system: enable the system to adapt to different types of time series data, effectively deal with noise, changes and complex dependencies in the data, and be suitable for various application scenarios.

[0046] 3. Reduce reliance on manual rules: Using unsupervised learning mode, there is no need to manually label data or preset rules, which automates the detection process and improves efficiency.

[0047] Based on the above objectives, the present invention proposes to realize efficient and accurate anomaly detection of complex time series data through TCN-LSTM-CMA autoencoder and combined with isolation forest method, which greatly improves the detection accuracy and system robustness, and has important practical application value and broad application prospects. This method not only solves the problems of low detection accuracy, poor adaptability and excessive reliance on artificial rules in the prior art, but also provides an efficient and intelligent solution for time series data anomaly detection in the fields of industrial monitoring, network security, etc.

[0048] First, the professional terms or abbreviations used in the present invention are explained:

[0049] Autoencoder: Autoencoder is a neural network model that is mainly used for data dimensionality reduction, feature extraction, and data reconstruction. It consists of two parts: an encoder and a decoder. It compresses the input data, learns the low-dimensional representation of the data, and reproduces the original data.

[0050] Temporal Convolutional Network (TCN): Temporal Convolutional Network is a deep learning model for processing sequence data. TCN uses causal convolution and dilated convolution to learn the temporal dependencies of data. Causal convolution ensures that the output time step depends only on the current and previous time steps, not on future time steps, to maintain the temporal order of time series data and avoid information leakage. In causal convolution, the scope of the convolution kernel is limited to the current and previous time steps. Dilated convolution is to expand the receptive field of the convolution kernel by inserting holes between adjacent elements of the convolution kernel during the convolution operation. This method can capture longer temporal dependencies without increasing the size of the convolution kernel.

[0051] Long Short-Term Memory Network (LSTM): Long Short-Term Memory Network is an improved recurrent neural network (RNN) designed specifically to solve the gradient vanishing and gradient exploding problems in RNN. LSTM can effectively capture and utilize long-term dependencies in sequence data by introducing a gating mechanism. LSTM has significant advantages in processing long sequence data.

[0052] Causal Masked Attention (CMA): Causal Masked Attention is an attention mechanism that is usually used for processing sequence data to ensure that only the previous time step information is considered when predicting the current time step. It can effectively model the causal relationship of the data and improve the prediction accuracy and interpretability of the model.

[0053] Isolation Forest: Isolation Forest is an unsupervised anomaly detection algorithm based on a tree structure. It builds decision trees by randomly selecting features and split values, and identifies anomalies by the depth of the split point. Each tree in the isolation forest is built by randomly selecting features and split points, and the depth of the tree reflects the degree of isolation of the sample. Anomalies can usually be isolated at a shallow tree level, while normal points require a deeper tree level to be isolated. The anomaly score of a sample is determined by calculating the average depth at which it is isolated in the forest. The higher the score, the more likely the sample is an anomaly.

[0054] Next, the specific implementation modes of the present invention are given through the following several embodiments, so as to illustrate the technical solutions of the present invention in more detail.

[0055] Embodiment 1: This embodiment provides a method for constructing a time series data anomaly detection model, comprising the following steps:

[0056] S1. Construct a data set generation module, which obtains time series data, preprocesses the time series data, and generates a data set;

[0057] S2. Construct an autoencoder module, which consists of an encoder and a decoder;

[0058] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0059] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

[0060] Specifically, step S1 is the construction step of the dataset generation module:

[0061] S11, normalizing the time series data input into the data set generation module, filling in missing values, and serializing in chronological order;

[0062] S12. Use the sliding window method to construct the data set. The preprocessed time series data is shown in Table 1.

[0063] Table 1 Preprocessed time series data

[0064] Feature 1 Feature 2 ... Features <![CDATA[Timestamp t1]]> <![CDATA[x1]]> <![CDATA[y1]]> ... <![CDATA[z1]]> <![CDATA[Timestamp t2]]> <![CDATA[x2]]> <![CDATA[y2]]> ... <![CDATA[z2]]> ... ... ... ... ... <![CDATA[Timestamp t n > <![CDATA[x n ]]> <![CDATA[y n ]]> ... <![CDATA[z n ]]>

[0065] For the time series data in Table 1, the timestep is set to 10, and the constructed data set is shown in Table 2.

[0066] Table 2 Constructed dataset

[0067]

[0068]

[0069] Step S2 is the step of constructing the autoencoder module. The constructed time series dataset is input into the autoencoder model. The goal of the autoencoder is to learn an effective compressed representation (encoding part) and then reconstruct the input sequence from this representation (decoding part).

[0070] The autoencoder module consists of two parts: encoder and decoder.

[0071] In this embodiment, the encoder adopts the TCN-LSTM-CMA framework.

[0072] TCN code:

[0073] The model first receives a sequence data of shape (batch_size, time_steps, n), where batch_size is the number of samples fed into the model in one training iteration, time_steps represents the time step, and n represents the number of features. TCN (Temporal Convolutional Network) extracts local features in the sequence through causal convolution and dilated convolution operations. The result of the convolution is to map the input n features to a higher dimensional hidden_dim, thereby capturing richer temporal information. The output shape is (batch_size, time_steps, hidden_dim), where hidden_dim is the dimension of the hidden layer.

[0074] TCN uses causal convolution and dilated convolution to capture the temporal dependencies in the data and extract useful feature sequences while maintaining the structure of the data.

[0075] LSTM Encoding:

[0076] The output from TCN is further processed by LSTM (Long Short-Term Memory Network). LSTM generates a series of hidden states, where the last hidden state contains the comprehensive information of the entire sequence. The hidden state of the last time step is extracted with a shape of (batch_size, 1, hidden_dim) for subsequent steps.

[0077] LSTM further models the long-term dependencies in time series, captures the deep temporal features in the sequence, and enhances the ability to express implicit information in the data.

[0078] Causally Masked Self-Attention Layer:

[0079] Repeat the last hidden state of the LSTM encoder time_steps times to form an input of shape (batch_size, time_steps, hidden_dim). The Causal Masked Attention (CMA) mechanism calculates the correlation of each position in the input sequence, shields future information, and only focuses on historical information related to the current time step, ensuring that the model makes predictions based only on known past information. The output shape is still (batch_size, time_steps, hidden_dim), and the data at each time step has been causally masked, including attention to historical information.

[0080] The causal masking self-attention mechanism (CMA) performs self-attention operations on key points in the time series to enhance the model's selective attention to important time points while maintaining causal relationships and avoiding information leakage. This mechanism ensures that the model can better capture abnormal features when processing time series, thereby improving the reconstruction quality and the accuracy of anomaly detection.

[0081] In this embodiment, the decoder adopts the LSTM-TCN framework.

[0082] LSTM Decoding:

[0083] The feature sequence after CMA processing enters the decoder part. LSTM decodes these data and the output shape is (batch_size, time_steps, hidden_dim).

[0084] The decoder first uses the LSTM module for decoding, gradually restoring the temporal dependency and structural information in the sequence to maintain the continuity and temporal characteristics of the data.

[0085] TCN decoding:

[0086] The data decoded by LSTM is passed to the TCN module, and the TCN decoder maps the hidden state sequence back to the original feature space through the deconvolution operation. This step decodes the high-dimensional hidden state back to the original features with practical significance, thereby restoring the feature dimension of the input data. The shape of the final output is (batch_size, time_steps, n), which is the same as the shape of the original input, which means that the model successfully learned and reconstructed the reconstructed data set shown in Table 3 and the reconstructed time series data shown in Table 4 through the encoding and decoding process of the original data.

[0087] Table 3 Reconstructed dataset

[0088]

[0089]

[0090] Table 4 Reconstructed timing data

[0091] Feature sequence <![CDATA[Timestamp t 10 > <![CDATA[[x’ 10 ,y’ 10 ...z’ 10 ]]]> <![CDATA[Timestamp t 11 > <![CDATA[[x’ 11 ,y’ 11 ...z’ 11 ]]]> ... ... <![CDATA[Timestamp t n > <![CDATA[[x’ n ,y’ n ...z’ n ]]]>

[0092] The TCN decoder performs the final feature reconstruction and output. The TCN decoder ensures the structural reconstruction of the data through convolution operations and generates a reconstructed sequence similar to the original input data.

[0093] In summary, the construction method of the time series data anomaly detection model of Example 1 provides a new way to implement the autoencoder. The encoding module and decoding module of the autoencoder both adopt a new architecture. Among them, TCN-LSTM-CMA is used as the encoder module. In the decoder part, the corresponding LSTM-TCN structure is adopted. The TCN-LSTM-CMA structure can effectively capture the long-term dependence and complex feature relationships in the time series data. TCN can extract features of different time scales through different convolutional layers, and enhance feature representation through dimensional expansion, thereby improving the flexibility and diversity of the model. LSTM further enhances the modeling ability of long-term relationships in time series, and can capture global features and trends across time steps. The output obtained by this module is then processed by CMA, which can further enhance the model's attention to key time points and important features. CMA not only ensures that the model can only rely on past information for prediction and prevents the leakage of future information, but also effectively improves the model's sensitivity and reaction speed to abnormal changes in time series by dynamically adjusting the importance of each time step, thereby better learning the time series characteristics of data and improving the accuracy and robustness of anomaly detection. This innovative architecture enables the model to not only perform well in processing conventional time series data, but also demonstrate higher accuracy and reliability in complex, multi-dimensional time series scenarios.

[0094] Embodiment 2: This embodiment provides a method for detecting anomalies in time series data.

[0095] First, the construction method of Example 1 can be used to construct a time series data anomaly detection model, so as to reconstruct the time series data; on this basis, continue to perform the following steps:

[0096] S3, calculating the reconstruction error by comparing the time series data before and after reconstruction with the reconstructed data;

[0097] The original input sequence is recorded as: T = [x, y, ..., z]

[0098] The reconstructed input sequence is recorded as: T + =[x′,y′,...,z′]

[0099] Reconstruction error calculation formula: ε = [xx+ ,yy + ,...,zz + ]

[0100] By comparing the reconstructed sequence with the original input data, the reconstruction error is calculated. The size of the reconstruction error reflects the degree of abnormality of the data. A larger error may indicate that the data point is abnormal, and the calculation result will be used in the subsequent anomaly detection step.

[0101] S4. Based on the calculated reconstruction error, the isolation forest algorithm is used to perform anomaly detection to identify abnormal data in the time series data.

[0102] Isolation Forest is an unsupervised anomaly detection algorithm. Its basic idea is to isolate data points by constructing a set of isolated trees by randomly selecting features and split values. Because outliers are relatively sparse in the data set, they are usually isolated faster, that is, they have a shorter path length. The anomaly score of each data point is calculated by the average path length of multiple isolated trees. The higher the score, the more likely it is an outlier. Isolation Forest does not require pre-labeled data and is very efficient when processing high-dimensional data. The closer the anomaly score is to 1, the more likely it is an outlier, and the closer it is to 0, the more likely it is a normal point.

[0103] This embodiment can accurately identify anomalies in complex time series data by combining TCN-LSTM-CMA autoencoder with isolation forest. Compared with the traditional single model method, TCN-LSTM-CMA autoencoder can fully extract the local and global features of time series data. At the same time, the isolation forest model further improves the accuracy of anomaly detection by modeling the reconstruction error, avoids complex manual rule setting, and effectively reduces the false detection rate and missed detection rate.

[0104] Embodiment 3: This embodiment provides a time series data anomaly detection system, including:

[0105] The time series data anomaly detection model building module is used to build a time series data anomaly detection model and reconstruct the time series data into reconstructed data similar to the time series data, including:

[0106] A data set generation submodule is used to obtain time series data, and pre-process the time series data to generate a data set;

[0107] The autoencoder module submodule consists of two parts: encoder and decoder;

[0108] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0109] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in turn. ;

[0110] A reconstruction error acquisition module is used to calculate the reconstruction error by comparing the time series data before and after reconstruction with the reconstruction data;

[0111] The anomaly detection module is used to perform anomaly detection based on the calculated reconstruction error and use the isolation forest algorithm to identify abnormal data in the time series data.

[0112] Embodiment 4: This embodiment provides a non-transitory computer-readable storage medium, on which computer instructions are stored, and the computer instructions enable a computer to execute a time series data anomaly detection method, the method comprising the following steps:

[0113] S1. Construct a data set generation module, which obtains time series data, preprocesses the time series data, and generates a data set;

[0114] S2. Construct an autoencoder module, which consists of an encoder and a decoder;

[0115] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0116] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

[0117] S3, calculating the reconstruction error by comparing the time series data before and after reconstruction with the reconstructed data;

[0118] S4. Based on the calculated reconstruction error, the isolation forest algorithm is used to perform anomaly detection to identify abnormal data in the time series data.

[0119] Embodiment 5: This embodiment provides an electronic device, which may include: a processor, a communications interface, a memory, and a communication bus, wherein the processor, the communications interface, and the memory communicate with each other via the communication bus. The processor may call the logic instructions in the memory to execute a method for detecting anomalies in time series data, and the method includes the following steps:

[0120] S1. Construct a data set generation module, which obtains time series data, preprocesses the time series data, and generates a data set;

[0121] S2. Construct an autoencoder module, which consists of an encoder and a decoder;

[0122] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0123] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

[0124] S3, calculating the reconstruction error by comparing the time series data before and after reconstruction with the reconstructed data;

[0125] S4. Based on the calculated reconstruction error, the isolation forest algorithm is used to perform anomaly detection to identify abnormal data in the time series data.

[0126] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0127] Embodiment 6: This embodiment provides a computer program product, which includes a computer program. The computer program can be stored in a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a time series data anomaly detection method, which includes the following steps:

[0128] S1. Construct a data set generation module, which obtains time series data, preprocesses the time series data, and generates a data set;

[0129] S2. Construct an autoencoder module, which consists of an encoder and a decoder;

[0130] The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features;

[0131] The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

[0132] S3, calculating the reconstruction error by comparing the time series data before and after reconstruction with the reconstructed data;

[0133] S4. Based on the calculated reconstruction error, the isolation forest algorithm is used to perform anomaly detection to identify abnormal data in the time series data.

[0134] Through the above embodiments, the advantages of the present invention corresponding to the purpose of the present invention are as follows:

[0135] 1. High-precision detection: The present invention enables the system to accurately capture the complex dependencies and key feature information in time series data, efficiently identify anomalies in the data, improve the accuracy of anomaly detection, and significantly reduce false positives and missed positives.

[0136] 2. Strong adaptability and robustness: The present invention can dynamically adjust model parameters according to different time series data to meet the needs of different scenarios. The system can still maintain stable detection performance when facing noise, data anomalies or changes.

[0137] 3. Low manual dependence: The present invention adopts an unsupervised learning model, which does not require manual labeling of the data set, significantly reducing the dependence on artificial rules and prior knowledge.

[0138] 4. Strong data processing capability: The present invention can process high-dimensional, multi-variable complex time series data, accurately identify anomalies through hierarchical feature extraction of deep learning models, and is suitable for large-scale data analysis tasks.

[0139] In summary, this patent proposes a new TCN-LSTM-CMA autoencoder method, combined with the isolation forest method, to detect anomalies in time series data. The above method overcomes the shortcomings of existing anomaly detection methods in terms of accuracy, adaptability and robustness. This method has broad application prospects in the field of time series data anomaly detection in industrial monitoring, network security and other fields.

[0140] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing a time series data anomaly detection model, characterized in that: The steps include: S1. Construct a data set generation module, which obtains time series data, preprocesses the time series data, and generates a data set; S2. Construct an autoencoder module, which consists of an encoder and a decoder; The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features; The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

2. The method for constructing a time series data anomaly detection model according to claim 1, characterized in that: In step S1, the time series data is preprocessed, specifically including: S11, normalizing the time series data input into the data set generation module, filling in missing values, and serializing in chronological order; S12. Use the sliding window method to construct the data set.

3. The method for constructing a time series data anomaly detection model according to claim 1, characterized in that: In step S2, the encoder adopts the TCN-LSTM-CMA framework, and the preprocessed data set first enters the temporal convolutional network of the encoder part, and the temporal convolutional network extracts useful feature sequences while maintaining the data structure; The feature sequence output from the temporal convolutional network enters the long short-term memory network, which captures the deep temporal features in the sequence and enhances the ability to express implicit information in the data; After encoding is completed, the feature sequence output by the long short-term memory network is combined with the causal masked self-attention mechanism to perform self-attention operations on the key points in the time series.

4. The method for constructing a time series data anomaly detection model according to claim 3, characterized in that: In step S2, the decoder adopts the LSTM-TCN framework, and the feature sequence processed by the causal masking self-attention mechanism enters the long short-term memory network of the decoder part, and the long short-term memory network gradually restores the time dependency and structural information in the sequence; The long short-term memory network passes the decoded data to the temporal convolutional network module of the decoder part for final feature reconstruction and output.

5. A time series data anomaly detection method, characterized in that: First, the time series data anomaly detection model constructed by the construction method described in any one of claims 1 to 4 is used to reconstruct the time series data; and then the following steps are continued: S3, calculating the reconstruction error by comparing the time series data before and after reconstruction with the reconstructed data; S4. Based on the calculated reconstruction error, the isolation forest algorithm is used to perform anomaly detection to identify abnormal data in the time series data.

6. A time series data anomaly detection system, characterized in that: include: A time series data anomaly detection model building module is used to build a time series data anomaly detection model and reconstruct the time series data into reconstructed data similar to the time series data; A reconstruction error acquisition module is used to calculate the reconstruction error by comparing the time series data before and after reconstruction with the reconstruction data; The anomaly detection module is used to perform anomaly detection based on the calculated reconstruction error and use the isolation forest algorithm to identify abnormal data in the time series data.

7. The time series data anomaly detection system according to claim 6, characterized in that: The time series data anomaly detection model building module includes: A data set generation submodule is used to obtain time series data, and pre-process the time series data to generate a data set; The autoencoder module submodule consists of two parts: encoder and decoder; The encoder adopts the TCN-LSTM-CMA framework, and the data set is sequentially passed through the temporal convolutional network, long short-term memory network and causal masked self-attention mechanism of the encoder part to extract features; The decoder adopts the LSTM-TCN framework, and the features extracted by the encoder are reconstructed into reconstructed data similar to the time series data through the long short-term memory network and the time series convolution network of the decoder part in sequence.

8. A non-transitory computer-readable storage medium having computer instructions stored thereon, the computer instructions enabling a computer to execute the time series data anomaly detection method according to claim 5.

9. An electronic device, comprising: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus, and the processor calls the logic instructions in the memory to execute the time series data anomaly detection method according to claim 5.

10. A computer program product, comprising a computer program, which can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the time series data anomaly detection method according to claim 5.

Images