Multivariable time sequence anomaly detection method and device fusing feature correlation and time sequence dependency

Abstract

The invention relates to a multivariable time sequence anomaly detection method fusing feature correlation and time sequence dependency, and the method comprises the following steps: obtaining multivariable time sequence data, and obtaining a time sequence feature; calculating a mutual information coefficient between any two time sequence characteristics at the current moment; according to historical data in the multivariable time sequence data, predicting a time sequence feature at the current moment to obtain a prediction feature; constructing a graph neural network, taking the prediction features as nodes of the graph neural network, obtaining a relation coefficient of adjacent nodes through mutual information coefficients, and carrying out information aggregation on the graph neural network to obtain a prediction value of the prediction features at the current moment; and calculating the deviation between the predicted value and the current time sequence characteristic, and carrying out anomaly scoring according to the deviation. According to the method, the mutual information coefficient (MIC) and the graph neural network (GNN) are combined, the nonlinear dependency relationship among multiple variables and the dynamic change rule of the time sequence can be captured at the same time, and the accuracy and robustness of anomaly detection are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of time series analysis and anomaly detection, and particularly relates to a multivariate time series anomaly detection method and device that fuse feature correlation and temporal dependence. Background Art

[0002] The core objective of multivariate time series anomaly detection is to identify abnormal points or abnormal segments that significantly deviate from the normal pattern in multivariate time series data, so as to provide a basis for system monitoring, fault warning, and decision-making support. Traditional methods are mainly divided into statistical-based methods, machine learning-based methods, and deep learning-based methods. Statistical-based methods describe the normal behavior of time series by establishing statistical models, but it is difficult to capture the complex correlations and non-linear temporal dependencies between multiple variables. Machine learning-based methods use classifiers or regression models to identify anomalies, but rely on manual feature engineering and have insufficient modeling ability for temporal dynamic changes. Deep learning methods automatically learn temporal features through neural networks, but usually ignore the correlations between multiple variables and have poor adaptability to the situation of scarce abnormal samples.

[0003] In summary, the existing methods have the following main limitations in multivariate time series anomaly detection:

[0004] (1) Multivariate time series data usually consists of multiple features, and there are often complex correlations between these features. The relationship between features may be direct (such as proximity in physical location or similarity in measurement), or indirect (such as different perspectives reflecting the same physical process). However, traditional anomaly detection methods usually regard each feature as an independent individual and lack modeling of the correlations between them. This neglect may lead to the inability to accurately identify some abnormal behaviors with strong dependencies. For example, some anomalies may be the result of certain feature combinations rather than the deviation of a single feature. Effectively capturing the longitudinal dependence between these features helps to improve the accuracy and stability of detection.

[0005] (2) Time series data has significant time dependence, that is, the value at the previous time step may affect the value at the current moment. In multivariate time series data, the reading of a certain feature is not only affected by its historical value, but may also be affected by the values of other features at the same moment and their historical values. Traditional anomaly detection methods usually regard the data as independent time points and ignore the dynamic changes and dependencies in the time dimension. Therefore, many methods fail to fully utilize the long-term and short-term change patterns in time series data, resulting in poor performance in identifying abnormal behaviors with strong dependencies. Effectively capturing this horizontal temporal dependence is the key to improving the accuracy of anomaly detection. Summary of the Invention

[0006] The object of the present invention is to provide a multivariate time series anomaly detection method and device that fuse feature correlation and temporal dependence, capture the non-linear dependence relationship between multivariate and the dynamic change law of time series simultaneously, and significantly improve the accuracy and robustness of anomaly detection;

[0007] To achieve the above object, the technical solution adopted by the present invention is:

[0008] A multivariate time series anomaly detection method that fuses feature correlation and temporal dependence, comprising the following steps:

[0009] Obtain multivariate time series data to obtain temporal features;

[0010] Calculate the mutual information coefficient between any two temporal features at the current moment;

[0011] According to the historical data in the multivariate time series data, predict the temporal features at the current moment to obtain predicted features;

[0012] Construct a graph neural network, use the predicted features as the nodes of the graph neural network, obtain the relationship coefficients of adjacent nodes through the mutual information coefficient, and aggregate the information of the graph neural network to obtain the predicted value of the predicted features at the current moment;

[0013] Calculate the deviation between the predicted value and the temporal features at the current moment, and perform anomaly scoring according to the magnitude of the deviation.

[0014] Preferably, the mutual information coefficient is expressed as:

[0015]

[0016] where p(s i (t), s j (t)) represents the joint probability distribution of the i-th and j-th features at time step t, and p(s i (t)) and p(s j (t)) are the marginal probability distributions of the i-th and j-th features respectively.

[0017] Preferably, the predicted features at the current moment are predicted using the temporal features of the past ω time steps:

[0018] x(t) = [s(t - ω), s(t - ω + 1),..., s(t - 1)]

[0019] where s(t) represents the value of the temporal feature at time t.

[0020] Preferably, the aggregated representation of the predicted features at time t is:

[0021]

[0022] Among them, x i (t) is the input feature of node i at time t, W ∈ R N*ω is a trainable weight matrix, N(i) is the set of neighbor nodes of node i, and α i,j represents the relationship coefficient between node i and neighbor node j.

[0023] Preferably, the predicted value of the predicted feature at the current time is obtained through the aggregation operation of the graph neural network:

[0024]

[0025] Preferably, the following steps are further included:

[0026] Train the graph neural network, where the loss function for training the graph neural network is:

[0027]

[0028] Preferably, the loss function is:

[0029]

[0030] Among them, ε is a threshold.

[0031] Preferably, the deviation between the predicted value and the time series feature at the current time is expressed as:

[0032]

[0033] When the deviation Δs(t) exceeds the preset threshold θ, it indicates that there is an abnormality in the prediction at this time.

[0034] The present invention also provides a computer-readable storage medium, on which a computer program is stored. It is characterized in that when the computer program is executed by a processor, it executes the steps in the above-mentioned multivariate time series anomaly detection method that fuses feature correlation and time series dependence.

[0035] The present invention also provides a multivariate time series anomaly detection device that fuses feature correlation and time series dependence, including:

[0036] A memory for storing software application programs,

[0037] A processor for executing the software application programs, and each program of the software application programs correspondingly executes the steps in the above-mentioned multivariate time series anomaly detection method that fuses feature correlation and time series dependence.

[0038] The present invention uses the mutual information coefficient (MIC) to model the non - linear dependence relationships between features in multivariate time series. Traditional correlation measurement methods (such as Pearson correlation coefficient) can only capture linear relationships, while MIC can effectively identify and quantify non - linear dependence relationships. By constructing a mutual information matrix, it can accurately capture the complex associations between multivariate variables, providing support for subsequent time series modeling and anomaly detection, dynamically capturing the time - varying relationships between features, and significantly improving the adaptability of the model to complex multivariate systems.

[0039] The present invention proposes a time series prediction method based on graph neural network (GNN) for capturing the dynamic dependencies in time series. By constructing a graph structure to represent the dependence relationships between multivariate variables, GNN can combine historical data and the information of neighbor nodes for time series prediction. It can not only capture the long - term and short - term dependence relationships of time series, but also adapt to the real - time changes between multivariate variables by dynamically adjusting the graph structure. By introducing a reward mechanism, the model can dynamically adjust the learning process according to the prediction error during training, further improving the prediction accuracy and training efficiency.

[0040] The present invention calculates the deviation between the model prediction value and the actual value for anomaly scoring. By setting a threshold, the deviation detection module can effectively distinguish normal behavior from abnormal behavior, significantly reducing the false alarm rate and missed detection rate. This module can not only detect anomalies of a single feature, but also identify abnormal behaviors of multivariate combinations, improving the comprehensiveness and accuracy of anomaly detection.

[0041] The present invention significantly improves the computational efficiency of the model through lightweight design and parallel computing optimization, enabling it to be applicable to large - scale real - time monitoring scenarios. Experimental results show that this framework performs excellently on multiple public datasets, outperforming existing mainstream methods.

[0042] The present invention introduces a dynamic reward mechanism during the model training process. By comparing the prediction error with a preset threshold, the loss function is dynamically adjusted. When the prediction error is small, a positive reward is given to the model to accelerate model convergence; when the prediction error is large, no reward is given to avoid over - adjustment. This mechanism significantly improves the training efficiency and prediction accuracy of the model, providing a more stable performance guarantee for anomaly detection.

[0043] In summary, by integrating feature correlation and time series dependence, the present invention proposes an efficient and robust multivariate time series anomaly detection method, solving the limitations of existing methods in modeling complex multivariate relationships and time - dimension changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic flow diagram of the present invention;

[0045] Figure 2This is the result graph of the evaluation metrics of the method of the present invention on the SWaT dataset;

[0046] Figure 3 This is the result graph of the evaluation metrics of the method of the present invention on the BATADAL dataset;

[0047] Figure 4 This is the result graph of the evaluation metrics of the method of the present invention on the MSL dataset;

[0048] Figure 5 This is the result graph of the evaluation metrics of the ablation experiment of the method of the present invention;

[0049] Figure 6 This is the training loss graph of the method of the present invention. Detailed implementation manners

[0050] The following further describes the present invention in conjunction with the accompanying drawings and specific embodiments.

[0051] A multivariate time series anomaly detection method that fuses feature correlation and temporal dependence according to the present invention includes the following steps:

[0052] S1. Obtain multivariate time series data to obtain temporal features;

[0053] Specifically, collect multivariate time series data from the target system. Each variable represents a feature, and the data is recorded at time steps. Represent the multivariate time series data as a matrix, where each column represents a feature (i.e., the reading of a sensor), and each row represents a time step. For N features (sensors) and T time steps, the data matrix is represented as:

[0054]

[0055] where, s i (t) represents the value of the i-th feature at time step t, and the data matrix X ∈ R T*N fully reflects the relationship between time (horizontal dimension) and features (vertical dimension).

[0056] S2. Feature association module: Calculate the mutual information coefficient between any two temporal features at the current moment;

[0057] Specifically, the relationship between features is quantified by the mutual information coefficient (MIC). For two features s i (t) and s j (t), their dependence at time step t can be represented by calculating their mutual information coefficient MIC(s i , s j ) as follows:

[0058]

[0059] where p(s i (t), s j (t)) represents the joint probability distribution of the i-th and j-th features at time step t, and p(s i (t)) and p(s j (t)) are the marginal probability distributions of the i-th and j-th features respectively. To represent this process more clearly, a mutual information matrix M can be constructed, where each element M i,j represents the mutual information between features s i and s j :

[0060]

[0061] The matrix element M i,j = I(s i , s j ) represents the mutual information between the i-th and j-th features. This matrix shows the interdependencies among all features, making it more intuitive to identify which features are behaviorally related. In this representation, the mutual information matrix can quantify the interdependencies between each pair of features in multivariate time series data. These dependencies are crucial for anomaly detection because anomalies often stem from abnormal behavior or deviation between features. Using this matrix, the interactions between features can be accurately modeled, providing strong support for subsequent time series modeling and anomaly detection. Through a sliding window mechanism, the mutual information matrix is updated in real time to ensure that the model can adapt to the dynamic changes in the relationships between features.

[0062] S3. Time series prediction module: Based on the historical data in the multivariate time series data, predict the time series features at the current moment to obtain predicted features; construct a graph neural network, use the predicted features as the nodes of the graph neural network, obtain the relationship coefficients of adjacent nodes through the mutual information coefficient, and aggregate the information of the graph neural network to obtain the predicted value of the predicted features at the current moment;

[0063] Specifically, to perform time series prediction, the data of the previous step length before the current moment is used to predict the data at the current moment. When predicting the i-th feature s i (t) at time step t, the data of the past ω time steps is used for prediction:

[0064] x(t) = [s(t - ω), s(t - ω + 1),..., s(t - 1)]

[0065] x(t) is a vector containing the feature data of the past ω time steps. In a graph neural network (GNN), a graph is constructed to represent the dependencies between features. Each node in the graph represents a predicted feature, and the weights of the edges are learned based on the dependencies between the features. Next, the graph neural network captures the mutual influence between features through information passing between nodes, thereby generating accurate predictions. For node i (i.e., feature x i (t)), its aggregated representation z i (t) at time t is calculated through the convolutional operation of the graph neural network, which combines historical data and information from neighboring nodes:

[0066]

[0067] where x i (t) is the input feature of node i at time t, W ∈ R N*ω is the trainable weight matrix, N(i) is the set of neighboring nodes of node i, and α i,j represents the relationship coefficient between node i and neighboring node j. To calculate the influence between node i and neighboring node j, the normalized MIC coefficient is used. Specifically, the mutual information coefficient between each pair of nodes is calculated, and then the final attention coefficient α i,j is obtained through softmax normalization:

[0068]

[0069] In this way, the model can learn the influence between neighboring nodes based on the graph structure, thereby calculating an enhanced representation for each node.

[0070] The predicted value of node i is obtained through the aggregation operation of the graph neural network:

[0071]

[0072] The entire prediction result is output through a fully connected layer, predicting the values of all features at the current moment.

[0073] More specifically, to optimize the model, the mean squared error (MSE) is used as the loss function to train the model. The calculation formula of the loss function is:

[0074]

[0075] where is the predicted output of the model, and s(t) is the actual observed data, that is, the collected multivariate time series data. The loss function is used to measure the difference between the predicted value and the actual value. In this way, the nonlinear dependence relationship between features can be effectively captured, and the graph neural network can be fully utilized for information aggregation to generate more accurate time series predictions, which can help identify the deviation between the current moment and the expected behavior and further locate possible abnormal features.

[0076] More specifically, to enhance the model's sensitivity to accurate predictions, a reward mechanism is added during the training process to accelerate convergence and improve the prediction accuracy. The reward mechanism helps the model adjust the learning process according to the accuracy of its prediction results by introducing a dynamically adjusted factor into the loss function. Specifically, when the prediction error of the model is small, the reward mechanism gives the model positive feedback to encourage the model to continue optimizing in this direction; when the prediction error of the model is large, the mechanism avoids over-adjustment by not giving rewards to maintain the stability of the optimization process.

[0077] Specifically, the reward mechanism determines whether to give a reward by comparing the MSE with a preset threshold ε. When the MSE of the model is less than or equal to ε, it means that the model's prediction is relatively accurate. At this time, a reward λ = 1 is given to the model, so that the loss function promotes the model to continue making accurate predictions through the weighted term. When the MSE is greater than ε, it means that the prediction error is large. At this time, no reward is given, λ = 0, and the model will only rely on the standard loss function for optimization without being affected by additional rewards or punishments. This mechanism is reflected through the loss function, where:

[0078]

[0079] The λ of the loss function is determined by the following formula:

[0080]

[0081] The purpose of adding the reward mechanism is to guide the model learning by providing dynamic feedback, thereby improving the prediction accuracy and training efficiency of the model. The purpose of this mechanism is to help the model better learn how to adjust its parameters in the face of different prediction errors through rewards or no rewards during the training process, so as to more accurately capture the laws of the data.

[0082] S5. Deviation detection module: Calculate the deviation between the predicted value and the time series features at the current moment, and perform anomaly scoring according to the deviation size.

[0083] Specifically, the deviation between the model's predicted value and the actual value is calculated through the loss function to score potential anomalies. For the test data Y, the number of its features N is equal to the number of training data features. Assuming the test length is T`, then Y can be represented by the following matrix:

[0084]

[0085] The deviation can be expressed as:

[0086]

[0087] When the deviation Δs(t) exceeds the preset threshold θ, it indicates that the prediction at that moment is abnormal. For the anomaly score A(t) at each moment, the following method can be used to determine whether it is abnormal:

[0088]

[0089] In this way, the abnormal points in the model prediction can be effectively identified, providing support for anomaly detection in the system.

[0090] Based on multiple public datasets, a comprehensive experimental evaluation of the method of the present invention was carried out. Through comparative experiments with a variety of mainstream methods, the significant advantages of the proposed method in multiple evaluation metrics were verified. The experimental results show that the proposed method can effectively detect anomalies in complex scenarios while maintaining a low false alarm rate, demonstrating stronger robustness and generality. In addition, through time efficiency analysis, the feasibility of the model in practical applications was verified.

[0091] As can be seen from Table 1, the performance of the proposed method on the SWaT dataset has significant characteristics. Although its precision (0.765) is relatively low, its recall rate (0.954) is much higher than other methods, indicating that the method of the present invention can detect more abnormal samples, but to a certain extent increases the possibility of false alarms. Nevertheless, its F1 score (0.851) is still at a relatively high level, indicating that the method of the present invention achieves a good balance between precision and recall, and its comprehensive performance is better than some comparative methods (such as TranAD, IF, DAGMM, etc.). Compared with other methods, traditional methods such as SVM and TABOR perform better in precision, but have a lower recall rate, resulting in a low F1 score. Deep learning methods such as AE and LSTM-VAE perform excellently in precision (close to 0.99), but have a lower recall rate (0.629 and 0.637), indicating that these methods may have missed detection problems when detecting anomalies. The method of the present invention demonstrates its advantages in detecting abnormal samples through a high recall rate and a moderate F1 score, especially suitable for scenarios with high requirements for the missed detection rate. However, its relatively low precision also indicates room for further optimization to reduce the false alarm rate.

[0092] Table 1: Comparative experiments on the SWaT dataset

[0093]

[0094] As can be seen from Table 2, the performance of the method of the present invention on the MSL dataset is significantly better than other comparison methods. Its precision (0.922), recall (0.912) and F1-score (0.917) have all reached the highest level, indicating that the method of the present invention can not only maintain a low false alarm rate when detecting anomalies, but also effectively capture more abnormal samples, with excellent comprehensive performance. Compared with other methods, the method of the present invention achieves a better balance between precision and recall, demonstrating stronger robustness and generality.

[0095] Table 2: Comparative experiments on the MSL dataset

[0096]

[0097] The experimental results show that the method of the present invention performs excellently on different datasets, demonstrating strong robustness and generality. This method achieves a good balance in precision, recall and F1-score, can effectively detect abnormal samples and maintain a low false alarm rate, and is suitable for complex scenarios with high requirements for detection accuracy and coverage. Generally speaking, the method of the present invention shows excellent performance in diverse data environments, verifying its effectiveness and practicality in practical applications.

[0098] Afterwards, ablation experiments were conducted to verify the effectiveness of each module in the method of the present invention, and the roles of the feature association module and the reward mechanism in the loss function were mainly analyzed. Through comparisons on the dataset, the performance of the model under different configurations was evaluated, as shown in Table 3.

[0099] Table 3: Ablation experiments

[0100]

[0101] In Table 3, a represents replacing the mutual information coefficient (MIC) in the feature association module with the self-attention mechanism to verify the importance of MIC in modeling the non-linear dependence relationship between features; b represents removing the reward mechanism in the loss function and only using the standard mean square error (MSE) for training to verify the impact of the reward mechanism on the model training efficiency and prediction accuracy. Taking the MSL dataset as an example, the experimental results show that the F1-score of method a is 0.863, significantly lower than that of the method of the present invention. This indicates that MIC plays an important role in modeling the non-linear dependence relationship between features and can capture the complex associations between features more accurately. Although the self-attention mechanism can dynamically capture global dependencies, it performs weakly in explicitly modeling non-linear relationships; the F1-score of method b in the MSL dataset is 0.876, lower than that of the method of the present invention. This indicates that the reward mechanism plays an important role in optimizing the model training process, can accelerate model convergence and improve prediction accuracy, thereby enhancing the anomaly detection performance.

[0102] By comparing the model performance under different configurations, the effectiveness of each module in the method of the present invention is verified. The experimental results show that the mutual information coefficient (MIC) has significant advantages in modeling the non-linear dependence relationship between features, and can capture complex associations more accurately, while the attention mechanism performs weakly in this task; at the same time, the reward mechanism in the loss function plays a key role in accelerating the model convergence and improving the prediction accuracy, and the model performance drops significantly after its removal. These experimental results fully prove the robustness and generality of the proposed method in complex scenarios, providing an important basis for the further optimization of the model.

[0103] Finally, the performance of the model in terms of time efficiency is studied. Table 4 shows the comparison of the time efficiency of the method of the present invention on the SWaT and MSL data sets, with the unit of minutes / epoch. It can be seen from the table that the method of the present invention is significantly superior to the other two comparison methods in terms of time efficiency. Specifically, on the SWaT data set, the training time of the method of the present invention is 2.6 minutes / epoch, much lower than 13 minutes / epoch of OmniAnomaly, and the acceleration factor reaches 5; on the MSL data set, the training time of the proposed method is 4 minutes / epoch, compared with 11 minutes / epoch of OmniAnomaly, and the acceleration factor is 2.75. This shows that the method of the present invention not only improves the performance of anomaly detection by optimizing the feature association module and the reward mechanism, but also greatly reduces the training time per epoch, significantly improving the time efficiency of the model. These results further verify the high efficiency and feasibility of the method of the present invention in practical applications. The operating memory size of the device used in the experiment is 128G, the processor is Intel(R) Core(TM) i9-14900KF 3.20GHz, and the GPU is NVIDIA GeForce RTX 4090.

[0104] Table 4 Time Efficiency Analysis (minutes / epoch)

[0105]

[0106] The present invention also provides a computer-readable storage medium, on which a computer program is stored, characterized in that when the computer program is executed by a processor, it executes the steps in the above-mentioned multi-variable time series anomaly detection method that fuses feature correlation and time series dependence.

[0107] The present invention also provides a multi-variable time series anomaly detection device that fuses feature correlation and time series dependence, including:

[0108] A memory for storing software application programs,

[0109] A processor for executing the software application, and each program of the software application correspondingly executes the steps in the multivariate time series anomaly detection method for fusing feature correlation and temporal dependence described above.

Claims

1. A multivariate time series anomaly detection method integrating feature correlation and time series dependency, characterized in that: The following steps are involved: Obtain multivariate time series data and obtain time series features; Calculate the mutual information coefficient between any two time series features at the current moment; According to the historical data in the multivariate time series data, the time series characteristics of the current moment are predicted to obtain the predicted characteristics; Construct a graph neural network, use the prediction features as the nodes of the graph neural network, obtain the relationship coefficients of adjacent nodes through the mutual information coefficient, aggregate the information of the graph neural network, and obtain the prediction value of the prediction feature at the current moment; Calculate the deviation between the predicted value and the time series characteristics at the current moment, and perform anomaly scoring based on the size of the deviation.

2. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 1, characterized in that: The mutual information coefficient is expressed as: Among them, p(s i (t),s j (t)) represents the joint probability distribution of the i-th and j-th features at time step t, p(s i (t)) and p(s j (t)) are the marginal probability distributions of the i-th and j-th features, respectively.

3. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 1, characterized in that: The prediction feature at the current moment is predicted using the time series features of the past ω time steps: x(t)=[s(t-ω),s(t-ω+1),...,s(t-1)] Among them, s(t) represents the value of the time series feature at time t.

4. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 1, characterized in that: The aggregation of the prediction features at time t is expressed as: Among them, x i (t) is the input feature of node i at time t, W∈R N*ω is a trainable weight matrix, N(i) is the set of neighbor nodes of node i, α i,j Represents the relationship coefficient between node i and its neighbor node j.

5. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 1 or 4, characterized in that: The predicted value of the predicted feature at the current moment is obtained through the aggregation operation of the graph neural network:

6. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 1, characterized in that: The following steps are also included: The graph neural network is trained, where the loss function of training the graph neural network is:

7. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 6, characterized in that: The loss function is: Among them, ε is the threshold.

8. The multivariate time series anomaly detection method integrating feature correlation and time series dependency according to claim 1, characterized in that: The deviation between the predicted value and the current time series feature is expressed as: When the deviation Δs(t) exceeds the preset threshold θ, it indicates that the prediction at that moment is abnormal.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the multivariate time series anomaly detection method for fusing feature correlation and time series dependency as described in any one of claims 1 to 8 are performed.

10. A multivariate time series anomaly detection device integrating feature correlation and time series dependency, characterized in that: include: Memory, for storing software applications, A processor is used to execute the software application, each program of the software application correspondingly executes the steps of the multivariate time series anomaly detection method for fusing feature correlation and time series dependency as described in any one of claims 1 to 8.

Images