Time sequence anomaly detection method based on Granger causal bidirectional analysis

Abstract

The invention discloses a time sequence anomaly detection method based on Granger causal bidirectional analysis. According to the method, forward and backward analysis is carried out by tracking causal dependence of an abnormal moment and other moments respectively after the occurrence of an anomaly is detected. By constructing a condition prediction model, the influence intensity of different moments on the anomaly is quantitatively evaluated, so that the key moments causing the anomaly and being influenced by the anomaly are identified. According to the method, the complex dynamic and potential causal relationship in the time series data can be revealed, richer interpretation information is provided for anomaly detection, the accuracy and interpretability of anomaly positioning are improved, and the application range of anomaly detection is expanded.

Description

Technical Field

[0001] The present invention belongs to the field of multivariate time series anomaly detection, and relates to a time series anomaly detection method based on Granger causal bidirectional analysis. Background Art

[0002] A key objective of time series anomaly detection is to identify the key factors causing anomalies, that is, the "root causes" of anomalies. Traditional anomaly detection methods mainly focus on the feature representation at the anomaly moment, while ignoring the causal relationship between the anomaly and the moments before and after. This results in the detected anomalies often being "results" rather than "causes". The existing anomaly detection field faces two main challenges, leading to false alarms or missed detections: (i) improving the ability to analyze the root causes of anomalies; (ii) enhancing the dynamic adaptability in non-stationary time series. Summary of the Invention

[0003] To solve these problems, the present invention constructs a conditional prediction model to quantitatively evaluate the influence intensity of different moments on anomalies, thereby identifying the critical moments that cause anomalies and are affected by anomalies. It reveals the complex dynamics and potential causal relationships in time series data, provides richer explanatory information for anomaly detection, improves the accuracy and interpretability of anomaly localization, and expands the application scope of anomaly detection.

[0004] The technical solution of the present invention is as follows:

[0005] A time series anomaly detection method based on Granger causal bidirectional analysis. After detecting the occurrence of an anomaly, it performs forward and backward analysis by respectively tracing the causal dependencies between the anomaly moment and other moments.

[0006] The bidirectional causal analysis method constructs a conditional prediction model to quantitatively evaluate the influence intensity of different moments on anomalies, thereby identifying the critical moments that cause anomalies and are affected by anomalies.

[0007] Specifically, it includes the following steps:

[0008] (1), Initialize the relevant sensitivity sequence table and regular sequence table. When initializing, set the necessary input data and select the feature dimension and time dimension:

[0009] (2), Perform forward causality analysis: the causal dependence from the past to the future, that is, the current anomaly is caused by certain past states;

[0010] (3), Perform backward causality analysis: the causal dependence from the future to the past, that is, the current anomaly leads to certain future states;

[0011] (4) The results of forward and backward causal analysis are integrated to correct the anomaly scores, and finally the complete anomaly detection results are obtained.

[0012] Preferably, the specific steps of the above step (1) are as follows:

[0013] (1-1) Initialize the sensitivity sequence table for forward causal analysis, record the causal influence degree at each moment, and this table helps to evaluate which past states contribute greatly to the current anomaly;

[0014] (1-2) Initialize the regularity sequence table: for backward causal analysis, record the regularity and causal dependence at future moments, and this table reflects the influence of the current anomaly on future states;

[0015] (1-3) Select relevant feature dimensions according to the dimension of the input data. The selection of feature dimensions needs to ensure that the causal relationships in the time series can be accurately captured;

[0016] (1-4) When selecting the anomaly moment t a , select a time window before and after as the scope of causal analysis. This time window is usually expressed as [t a - Δt, t a + Δt], where Δt is the size of the time range.

[0017] Preferably, the specific steps of the above step (2) are as follows:

[0018] (2-1) Build prediction models: Build two prediction models to evaluate causal relationships:

[0019] Model 1: Only use the hidden states before t a to predict denoted as

[0020] Model 2: On the basis of Model 1, add for prediction, denoted as where is the hidden state at the past moment t p ∈ [t a - Δt, t a ).

[0021] (2-2) By comparing the prediction results of Model 1 and Model 2, define the prediction error:

[0022]

[0023] where is the current actual value, is the predicted value of Model 1, is the prediction error of Model 1;

[0024]

[0025] wherein is the current actual value, is the predicted value of Model 2, is the prediction error of Model 2;

[0026] (2-3), Calculate the causal strength: The backward causal strength is defined as the difference between the two errors:

[0027]

[0028] wherein is the causal strength, which is used to quantitatively measure the explanatory ability of the past state for the current anomaly, the larger it is, the more the prediction error decreases after adding , that is, the information contained in is more helpful for predicting , so and have a stronger causal relationship;

[0029] (2-4), Update the sensitivity sequence table: Calculate the causal strength for all past moments within the window, and select the K moments with the largest causal strength as the most "causal" moments. According to Granger causality theory, if adding can significantly improve the prediction of , then is called the "Granger cause" of .

[0030] Preferably, the specific steps of the above step (3) are as follows:

[0031] (3-1), Construct a prediction model: Construct two prediction models to evaluate the causal relationship:

[0032] Model 1: Only use the hidden state a after t to predict denoted as

[0033] Model 2: On the basis of Model 1, add to make a prediction, denoted as wherein is the hidden state at the abnormal moment t a .

[0034] (3-2), By comparing the prediction results of Model 1 and Model 2, define the prediction error:

[0035]

[0036] wherein is the actual value at a future time, is the predicted value of Model 1, is the prediction error of Model 1;

[0037]

[0038] wherein is the actual value at a future time, is the predicted value of Model 2, is the prediction error of Model 2;

[0039] (3-3) Calculate the causal strength: The backward causal strength is defined as the difference between the two errors:

[0040]

[0041] wherein is the causal strength, which is used to reflect the influence degree of the abnormal moment on the future state, The larger it is, it means that after adding the prediction error is reduced more, that is, the information contained is more helpful for predicting Therefore and have a stronger causal relationship;

[0042] (3-4) Update the regular sequence list: Calculate the causal strength for all future times within the window, and select the K moments with the largest causal strength as the "result" moments.

[0043] Preferably, the specific steps of the above step (4) are as follows:

[0044] (4-1) Correct the anomaly score: Combine the results of forward causal analysis and backward causal analysis to correct the anomaly score, so that the corrected anomaly score can more accurately reflect the actual impact of the anomaly;

[0045] (4-2) Through analysis, 2K key moments causally related to the abnormal moment t a are identified. These moments form a "causal context" around t a This context shows the possible causes before the anomaly occurs and the chain reaction caused after the anomaly occurs, providing a more comprehensive basis for explanation for subsequent decision-making, and at the same time helping to identify potential weak links or improvement points in the system.

[0046] Advantages of the present invention:

[0047] By constructing a conditional prediction model, the present invention quantitatively evaluates the influence intensity of different moments on anomalies, thereby identifying the critical moments that cause anomalies and are affected by anomalies. It reveals the complex dynamics and potential causal relationships in time series data, provides richer explanatory information for anomaly detection, improves the accuracy and interpretability of anomaly localization, and expands the application scope of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flowchart of the execution of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0049] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and cannot be used to limit the protection scope of the present invention.

[0050] As Figure 1 shown, a time series anomaly detection method based on Granger causal bidirectional analysis, after detecting the occurrence of an anomaly, respectively traces the causal dependencies between the anomaly moment and other moments for forward and backward analysis;

[0051] The bidirectional causal analysis method constructs a conditional prediction model to quantitatively evaluate the influence intensity of different moments on anomalies, thereby identifying the critical moments that cause anomalies and are affected by anomalies.

[0052] Specifically, it includes the following steps:

[0053] (1). Initialize the relevant sensitivity sequence table and regular sequence table. When initializing, set the necessary input data and select the feature dimension and time dimension:

[0054] (2). Conduct forward causality analysis: the causal dependence from the past to the future, that is, the current anomaly is caused by certain past states;

[0055] (3). Conduct backward causality analysis: the causal dependence from the future to the past, that is, the current anomaly causes certain future states;

[0056] (4). The results of the forward and backward causality analyses are integrated to correct the anomaly scores, and finally the complete anomaly detection results are obtained.

[0057] Preferably, the specific steps of the above step (1) are as follows:

[0058] (1-1). Initialize the sensitivity sequence table for forward causality analysis to record the causal influence degree of each moment. This table helps to evaluate which past states contribute more to the current anomaly in the follow-up;

[0059] (1-2) Initialize the regular sequence list: For backward causal analysis, record the regularity and causal dependencies at future times. This list reflects the impact of the current anomaly on future states;

[0060] (1-3) Select relevant feature dimensions according to the dimension of the input data. The selection of feature dimensions needs to ensure that the causal relationships in the time series can be accurately captured;

[0061] (1-4) When selecting the anomaly time t a , select a time window before and after as the scope of causal analysis. This time window is usually expressed as [t a - Δt, t a + Δt], where Δt is the size of the time range.

[0062] Preferably, the specific steps of the above step (2) are as follows:

[0063] (2-1) Build prediction models: Build two prediction models to evaluate causal relationships:

[0064] Model 1: Only use the hidden states before t a to predict Denote it as Denote as

[0065] Model 2: On the basis of Model 1, add to make predictions, denote it as where are the hidden states at the past time t p ∈ [t a - Δt, t a ).

[0066] (2-2) By comparing the prediction results of Model 1 and Model 2, define the prediction error:

[0067]

[0068] where is the current actual value, is the predicted value of Model 1, is the prediction error of Model 1;

[0069]

[0070] where is the current actual value, is the predicted value of Model 2, is the prediction error of Model 2;

[0071] (2-3), Calculate the causal strength: The backward causal strength is defined as the difference between two errors:

[0072]

[0073] where is the causal strength, used to quantitatively measure the explanatory ability of past states for current anomalies. The larger is, the more the prediction error decreases after adding , that is, the information contained in is more helpful for predicting . Therefore, the causal relationship between is stronger;

[0074] (2-4), Update the sensitivity sequence list: Calculate the causal strength for all past moments within the window, and select the K moments with the largest causal strength as the "cause" moments. According to Granger causality theory, if adding can significantly improve the prediction of under the condition of given past information, then is called the "Granger cause" of .

[0075] Preferably, the specific steps of the above step (3) are as follows:

[0076] (3-1), Build a prediction model: Build two prediction models to evaluate the causal relationship:

[0077] Model 1: Only use the hidden states a after t to predict , denoted as

[0078] Model 2: On the basis of Model 1, add to make a prediction, denoted as where is the hidden state at the abnormal moment t a .

[0079] (3-2), By comparing the prediction results of Model 1 and Model 2, define the prediction error:

[0080]

[0081] where is the actual value at the future moment, is the predicted value of Model 1, is the prediction error of Model 1;

[0082]

[0083] wherein is the actual value at a future time, is the predicted value of Model 2, is the prediction error of Model 2;

[0084] (3-3) Calculate the causal strength: The backward causal strength is defined as the difference between the two errors:

[0085]

[0086] wherein is the causal strength, which is used to reflect the influence of the abnormal moment on the future state. The larger is, the more the prediction error decreases after adding , that is, the more helpful the information contained in is for predicting . Therefore, the causal relationship between and is stronger;

[0087] (3-4) Update the regular sequence list: Calculate the causal strength for all future times within the window, and select the K moments with the largest causal strength as the "result" moments.

[0088] Preferably, the specific steps of the above step (4) are as follows:

[0089] (4-1) Correct the anomaly score: Combine the results of the forward causal analysis and the backward causal analysis to correct the anomaly score;

[0090] (4-2) Through analysis, 2K critical moments causally related to the abnormal moment t a are identified. These moments form a "causal context" around t a . This context shows the possible causes before the anomaly occurs and the chain reactions triggered after the anomaly, providing a more comprehensive basis for explanation for subsequent decision-making, and at the same time helping to identify potential weak links or improvement points in the system.

[0091] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the technical principle of the present invention, several improvements and deformations can be made, and these improvements and deformations should also be regarded as the protection scope of the present invention.​​​​​​

Claims

1. A time series anomaly detection method based on Granger causality bidirectional analysis, characterized in that: The benefits include the following steps: (1) Initialize the relevant sensitivity sequence table and regularity sequence table. During initialization, set the necessary input data and select the feature dimension and time dimension: (2) Conduct forward causal analysis: causal dependency from the past to the future, that is, the current anomaly is caused by certain states in the past; (3) Conduct backward causal analysis: causal dependence from the future to the past, that is, current anomalies lead to certain future states; (4) The results of forward and backward causal analysis are integrated and the anomaly scores are corrected to obtain the complete anomaly detection results.

2. The time series anomaly detection method based on Granger causality bidirectional analysis according to claim 1 is characterized in that: The specific steps of step (1) are as follows: (1-1) Initialize the sensitivity sequence table for forward causal analysis and record the causal influence at each moment; (1-2) Initialize the regularity sequence table: used for backward causal analysis, recording the regularity and causal dependency of future moments; (1-3) Select relevant feature dimensions based on the dimensions of the input data. The selection of feature dimensions needs to ensure that the causal relationship in the time series can be accurately captured; (1-4) When selecting the abnormal time t a When , a time window before and after is selected as the scope of causal analysis, and the time window is expressed as [t a -Δt,t a +Δt], where Δt is the size of the time frame.

3. The time series anomaly detection method based on Granger causality bidirectional analysis according to claim 1 is characterized in that: The specific steps of step (2) are as follows: (2-1) Constructing prediction models: Construct two prediction models to evaluate causal relationships: Model 1: Using only t a Previous hidden state predict Recorded as in is the abnormal time t a The hidden state of Model 2: Adding to Model 1 Make a prediction, denoted as in is the past time t p ∈[t a -Δt,t a )’s hidden state; (2-2) By comparing the prediction results of model 1 and model 2, the prediction error is defined as: in is the current actual value, is the predicted value of model 1, is the prediction error of model 1; in is the current actual value, is the predicted value of model 2, is the prediction error of model 2; (2-3) Calculate causal strength: The backward causal strength is defined as the difference between the two errors: in is causal strength; (2-4) Update the sensitivity sequence table: calculate the causal strength for all past moments in the window, and select the K moments with the largest causal strength as the most causal moments.

4. The time series anomaly detection method based on Granger causality bidirectional analysis according to claim 3 is characterized in that: The specific steps of step (3) are as follows: (3-1) Constructing prediction models: Construct two prediction models to evaluate causal relationships: Model 1: Using only t a The hidden state after predict Recorded as Model 2: Adding to Model 1 Make a prediction, denoted as (3-2) By comparing the prediction results of model 1 and model 2, the prediction error is defined as: in is the actual value at the future moment, is the predicted value of model 1, is the prediction error of model 1; in is the actual value at the future moment, is the predicted value of model 2, is the prediction error of model 2; (3-3) Calculate causal strength: The backward causal strength is defined as the difference between two errors: in is causal strength; (3-4) Update the regular sequence table: calculate the causal strength for all future moments in the window, and select the K moments with the largest causal strength as the final result moments.

5. The time series anomaly detection method based on Granger causality bidirectional analysis according to claim 4 is characterized in that: The specific steps of step (4) are as follows: (4-1) Correcting the anomaly score: Combine the results of forward causal analysis and backward causal analysis to correct the anomaly score; (4-2) Through analysis, the abnormal time t a There are 2K key moments of causal relationship, which revolve around t a A causal context is formed to understand why the anomaly occurred and its subsequent impact.

Images