Multivariable time series data anomaly detection system and method based on positive and negative correlation graph deviation

Abstract

The invention belongs to the technical field of data processing, and discloses a multivariable time sequence anomaly detection system and method based on positive and negative correlation graph deviation, and the system comprises a variable embedding module which is used for embedding each variable; the positive and negative variable correlation graph construction module is used for acquiring correlation of all time sequence variables so as to construct a positive and negative variable correlation graph of the multivariable time sequence; the information propagation and prediction module is used for obtaining information aggregation representation according to a correlation graph between positive and negative variables, and further obtaining a predicted value of each variable; the anomaly detector is used for calculating an error between a predicted value and an actual value of each variable to obtain anomaly-related time and variables. According to the invention, by introducing the positive and negative correlation diagram deviation, the dynamic dependency relationship between variables can be more accurately represented, the anti-interference capability of the system is improved, the time sequence anomaly detection performance is further improved, and the anomaly detection requirement in a complex scene is effectively met.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, relates to multivariate time series anomaly detection technology, and in particular to related technologies of graph neural networks (GNN) based on deep learning. It is a time series anomaly detection method based on positive and negative correlations between time series. Background Art

[0002] Multivariate time series data detection is a key technology for ensuring the security of large-scale cyber-physical systems, detecting cybersecurity intrusions, and preventing credit card fraud. Due to failures or attacks, multivariate time series data may contain values that significantly deviate from the normal trend. These values are often referred to as outliers. The process of finding and marking these outliers is generally defined as multivariate time series anomaly detection. This task provides early warning and prompts operators to address anomalies, which has significant practical significance for ensuring production safety and reducing economic losses. Therefore, it has attracted significant attention from both academia and industry.

[0003] However, unlike normal time series data, anomalies are often associated with rare events, so they account for a relatively small proportion. Collecting and labeling anomaly data is often a difficult and expensive task. Furthermore, establishing a complete set of potential anomaly events is often impossible, as this would undermine the effectiveness of supervised learning techniques. Therefore, current time series anomaly detection methods focus on detecting anomalies in unsupervised settings.

[0004] Traditional unsupervised time series anomaly detection methods include density-based, classification-based, and distribution-based methods. These traditional methods either fail to consider temporal information, making them difficult to widely use in real-world scenarios, or become ineffective as data dimensionality increases. With the development of deep neural networks, reconstruction- and prediction-based methods have become mainstream research directions for this task, using reconstruction error and prediction error as criteria for identifying outliers. However, these methods lack explicit modeling of relationships between variables, limiting their effectiveness in detecting anomalies under the influence of correlated time series variables. In recent years, graph neural networks have demonstrated their ability to effectively capture the temporal and spatial dependencies between pairs of variables, making them a leading technique in the time series field. However, existing time series anomaly detection methods using graph neural networks often ignore the dynamic nature of intervariate relationships. Furthermore, because the unique pattern of one variable in a multivariate time series may appear as noise to other uncorrelated variables, previous methods have only exploited positive intervariate dependencies, ignoring the important role of negative intervariate dependencies in modeling time series data. These limitations restrict the models' anomaly detection capabilities in complex scenarios, resulting in suboptimal detection results. Summary of the Invention

[0005] The purpose of the present invention is to address the above-mentioned technical problems existing in the prior art and design a novel multivariate time series data anomaly detection system and method based on positive and negative correlation graph deviations. By utilizing the positive and negative correlation dependencies between variables, the influence of positive and negative correlation variables on time series prediction is modeled respectively, and the size of the prediction error is used as an anomaly indicator to improve the accuracy of multivariate time series anomaly detection.

[0006] The concept of this invention is to decompose the relationships between multivariate time series into positive and negative dependencies, modeling the impact of positive and negative dependencies on the time series respectively. This method then uses a positive and negative correlation graph structure and a corresponding attention-based information propagation method to comprehensively obtain predicted data for each variable, thereby enabling anomaly detection in multivariate time series data. First, variable embedding is used to capture the behavior and characteristics of each variable. Second, the positive and negative dependencies between variables are learned to generate a positive and negative correlation graph. Then, graph attention weights derived from the different attributes of adjacent variables in the graph are used to obtain variable representations and predict future data. Finally, the absolute deviation between the predicted and true values is used to locate the time and variable where the anomaly occurred. This method not only captures the dynamic relationships between variables more comprehensively but also improves the model's anti-interference ability by rationally filtering out noise in the variable relationships. This effectively addresses anomaly detection needs in complex scenarios and further improves the performance of time series anomaly detection.

[0007] Based on the above inventive ideas, the present invention provides a multivariate time series anomaly detection system based on positive and negative correlation graph deviations, which includes:

[0008] The variable embedding module is used to embed each variable and obtain the variable embedding of each variable;

[0009] A positive and negative variable correlation diagram construction module is used to obtain the correlation of all variables, select positively correlated and negatively correlated variable dependencies, and thus construct a positive and negative variable correlation diagram of a multivariate time series; the positive and negative variable correlation diagram includes positive and negative correlations;

[0010] The information propagation and prediction module is used to obtain the attention coefficient based on the correlation diagram between positive and negative variables, and then aggregate the variable embeddings of each variable and the historical data after linear transformation to obtain the information aggregation representation; and then make predictions based on the variable embeddings and information aggregation representation to obtain the predicted value of each variable;

[0011] Anomaly detector is used to calculate the error between the predicted value and the actual value of each variable and obtain the time and variable related to the anomaly.

[0012] Since most of the data in the multivariate time series data anomaly detection task comes from different devices that change simultaneously over time, these variable data may show unique characteristics that are correlated with each other. In order to capture these relationships, this paper introduces a multidimensional embedding vector for each time series variable to represent the behavior of each variable, thereby capturing the "factors" behind its behavior. Each variable embedding is represented as vec i ∈R h . After these embeddings are randomly initialized, they are trained with the rest of the system based on the multivariate data within each sliding window. Through training, the variable embedding vectors become part of the graph neural network (GDN) parameters, enabling the system to better capture the specific properties of the variables and describe the unique behavioral representation of each variable. The variable embedding module first determines the typical dependencies and relational noise between variables, which are then used to form the inter-variable correlation graph; secondly, it can be used to represent the behavior of different variables in information propagation and prediction, thereby better focusing on the impact of different neighbor variable weights on the predicted value.

[0013] The positive and negative variable correlation graph construction module uses the variable embeddings obtained from the variable embedding module to learn the positive and negative correlations between variables in the form of a directed graph structure and generate an inter-variable correlation graph G. While eliminating the relationship noise of irrelevant variables, it selects typical positive and negative correlation variable dependencies to construct a correlation graph between positive and negative variables in a multivariate time series.

[0014] Use G = (V, E) to represent the directed graph, where V = {v1, v2, ..., vN} represents a variable node set, v i represents the i-th variable, N is the number of variables, E represents the edge set, and Respectively represent the variables v i to the variable v j The sets of directed positive and negative correlation edges between .

[0015] Furthermore, the module for constructing the correlation diagram between positive and negative variables includes:

[0016] Candidate relationship building unit, used to calculate the variable v i The variable embedding of the corresponding candidate relation variable v j The similarity of variable embeddings determines the variable v i dependencies;

[0017] A positive correlation building unit is used to sort in descending order of similarity and select several variables that are greater than a positive correlation threshold to form a positive correlation;

[0018] The negative correlation relationship building unit is used to arrange in descending order of similarity and select several variables whose values are less than a negative correlation threshold to form a negative correlation relationship; the negative correlation threshold is less than a positive correlation threshold.

[0019] In the above candidate relationship building unit, the variable v i The candidate relation of is defined as all variables except itself, that is, P i ={v1,v2,......,v N}\{i}. To determine the variable v i Dependency relationship, calculate the variable v i The embedding vector vec i and P i The similarity e between the variable embeddings of each variable in j,i The similarity formula is defined as:

[0020]

[0021] The above positive correlation building unit, for variable v i , according to the set positive correlation threshold, select K + The variables with the largest similarity score are regarded as positively correlated neighbors, forming a positive correlation relationship. The positive correlation threshold can be selected according to the actual situation of the data set. i , its positively correlated neighbor node set can be expressed as V + (v i ). The formula for defining positively correlated neighbors is:

[0022]

[0023] The above negative correlation building unit, for variable node v i , according to the set negative correlation threshold, select K - The variables with the smallest similarity scores are regarded as negatively correlated neighbors, forming a negative correlation relationship. In order to avoid the influence of the relationship noise of irrelevant variables, the negative correlation threshold can be selected according to the actual situation of the data set. i , its negatively correlated neighbor node set can be expressed as V - (v i ). The formula for defining negatively correlated neighbors is:

[0024]

[0025] Positive and negative correlations together form the correlation graph between positive and negative variables.

[0026] Because the present invention employs a prediction-based approach for anomaly detection in multivariate time series, this approach assumes low prediction errors during normal periods and high errors during anomalies. To improve prediction accuracy and amplify anomaly errors, the present invention's information propagation and prediction module, combined with the variable embeddings obtained by the variable embedding module, propagates and aggregates positive and negative correlation information from the inter-variable correlation graph G, ultimately using the resulting representation to predict future data at time step t. Because the information aggregation and propagation process for positive and negative correlations follows the same logic, the present invention uses the process for positively correlated neighbors as an example for detailed explanation.

[0027] In order to obtain the different effects of adjacent variables on the variable, we combine variable embedding and utilize the positive and negative correlation between variables. We use the attention function to assign different attention weights to each adjacent variable in the graph, thereby predicting the future value of the variable and obtaining the predicted values of all time series variables.

[0028] The above information dissemination and prediction modules include:

[0029] A variable feature construction unit is used to connect the variable embedding of each variable with the corresponding variable historical data after linear transformation to obtain the variable feature;

[0030] An attention coefficient calculation unit is used to obtain the positive or negative attention coefficient of any variable based on the corresponding variable characteristics, the variable characteristics of the positively correlated neighbor variables or the negatively correlated neighbor variables, and the learning coefficient vector through activation function and regularization processing;

[0031] An information aggregation representation generation unit is used to obtain, for any variable, an aggregate representation of positively correlated neighbors or an aggregate representation of negatively correlated neighbors by aggregating the variable's own attention coefficient, the positively correlated attention coefficient, or the negatively correlated attention coefficient, and the corresponding variable's historical data after linear transformation; and then aggregating the aggregate representation of positively correlated neighbors with the aggregate representation of negatively correlated neighbors to obtain an information aggregation representation;

[0032] The prediction unit is used to predict the predicted value of each variable based on the result obtained by element-by-element multiplication of the variable embedding of each variable and the corresponding aggregate information representation.

[0033] The above variable feature construction unit takes into account the unique attributes of each variable and is able to simultaneously combine the time and space characteristics of the time series, and embeds the variables used to characterize the corresponding behaviors of different variables into vec i and the historical window data after corresponding linear transformation Connect them to get the variable characteristics of the corresponding variables, and define the connection formula between the two as:

[0034]

[0035] Among them, x i is the historical window data of the i-th variable, W is the linear transformation weight of the time series, and the subscript t is omitted to simplify the formula.

[0036] The purpose of the above-mentioned attention coefficient calculation unit is to obtain the attention coefficient of the positively correlated neighbor information of the inter-variable correlation graph G.

[0037] Taking the calculation of positive correlation attention coefficient as an example, the calculation process is: the variable feature q i Variable characteristics q of positively correlated neighbor variables j The addition result is processed together with the learning coefficient vector a used for the attention mechanism, and the positive correlation attention coefficient π(i, j) is calculated through the activation function LeakyReLU, and then the positive correlation attention coefficient is regularized to obtain the regularized positive correlation attention coefficient (expressed as ), the whole process can be expressed as:

[0038]

[0039] in, represents transpose, q j is the variable characteristic of the negatively correlated neighbor variable, vec j is the variable embedding of the jth negatively correlated neighbor variable, x j is the historical window data of the jth negatively correlated neighbor variable.

[0040] Using the same operation, the negative correlation attention coefficient can be calculated The whole process can be expressed as:

[0041]

[0042] Among them, q j′ is the variable characteristic of the negatively correlated neighbor variable, vec j′ is the variable embedding of the j′th negatively correlated neighbor variable, x j′ is the historical window data of the j′th negatively correlated neighbor variable.

[0043] The above information aggregation representation generation unit is represented by the aggregation of positively correlated neighbors Taking generation as an example, the generation process can be expressed in the following form:

[0044]

[0045] Among them, α i,i For variable node v i Its own first regularized attention coefficient, For variable node v i For its positively correlated neighbor node v j Regularized positive correlation attention coefficient of x j is the historical window data of the jth positively correlated neighbor variable.

[0046] Using the same operation, we can generate an aggregate representation of negatively correlated neighbors The generation process can be expressed in the following form:

[0047]

[0048] in, For variable node v i Its own second regularized attention coefficient, For variable node v i For its negatively correlated neighbor node v j′ Regularized negative correlation attention coefficient, x j′ is the historical window data of the j'th negatively correlated neighbor variable.

[0049] Aggregate the information after positive and negative correlation propagation to obtain the variable v i Information aggregation representation Z i The corresponding mathematical expression of the whole process is:

[0050] Z i =z i+ +z i - (11).

[0051] Because Z i It is impossible to clearly distinguish the inherent properties of each variable. In order to bridge the gap between the variable representation and the intrinsic characteristics of each variable, a more accurate time series forecast value of each variable is obtained in the prediction unit. Here, the embedding vector of the specific variable is added, and the information aggregation representation {Z1, Z2, ..., Z N}, set the variable v i The corresponding variable embedding vector vec i Instead of element-wise multiplication, use the unique preferences of each variable to emphasize or suppress Z i The prediction unit is a stacked fully connected layer f with a hidden layer size h and an output dimension N. θ The prediction process formula is defined as:

[0052]

[0053] Finally, define the output values predicted by all variables and the observed true output value x t The mean square error between is used as the loss function during training, and the formula is as follows:

[0054]

[0055] Among them, T is the length of all time series in the training set, and L is the length of the input historical window time series data.

[0056] The above anomaly detector calculates a separate anomaly score for each variable and aggregates it into a single anomaly score for each time step, which can more clearly identify which variables exhibit anomalies.

[0057] Specifically, the variable v is calculated by comparing the predicted value at time t with the actual value observed at time t. i The absolute error is Dev i,t To determine the anomaly score. In addition, given the different characteristics of different variables, the magnitude of their anomaly deviation may be different. In order to prevent the anomaly deviation of any single variable from masking other variables, the absolute error Dev of each variable is calculated. i,t Normalize. This process is shown in formulas (14)-(15):

[0058]

[0059] Among them, xi,t is the actual value of the i-th variable at time t, is the predicted value of the i-th variable at time t, Dev i,t is the absolute error of the i-th variable at time t. Compared with the mean and standard deviation, the median and quartile values are more robust to abnormal phenomena. It is defined as the median absolute error (that is, the absolute error in the middle position when the absolute errors of each variable are arranged in ascending order), and Defined as the absolute error quartile value (i.e., arrange the variables in ascending order of absolute error, divide them into four equal parts, and take the absolute error at one-quarter position), d i (t) is the normalized result of the absolute error of the i-th variable.

[0060] Then, the total anomaly score at time t is calculated, and the anomaly deviations of all variables are aggregated using the maximum function to better highlight which variables have anomalies. The process is shown in formula (16). In order to prevent the sudden increase of normal data from causing excessive deviation of abnormal deviation, a simple moving average is selected to smooth the score and reduce the impact of spikes in normal data, where w is the smoothing window length, A s,t As the anomaly score. This process is formulated as:

[0061]

[0062] Among them, A t-k is the maximum value of the normalized absolute error of each variable at time tk, that is, the maximum abnormal value at time tk, A t is the maximum abnormal value at time t (i.e. k = 0), A s,t is the overall anomaly score at time t.

[0063] Finally, the anomaly score A at time t s,tWhen the set anomaly threshold is exceeded, the moment will be marked as an anomaly, and the corresponding variable is the variable corresponding to the anomaly. Although different methods can be used to set the threshold, such as extreme value theory (see Siffer A, Fouque PA, Termier A, et al. Anomaly detection in streams with extreme value theory [C] / / Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining. 2017: 1067-1075), in order to avoid introducing additional hyperparameters, the anomaly threshold is set to the corresponding A calculated based on the validation set in different datasets. s,t Maximum value.

[0064] The present invention also provides a multivariate time series anomaly detection method based on positive and negative correlation graph deviation, which is implemented using the above-mentioned multivariate time series anomaly detection system and includes the following steps:

[0065] S1, embed each variable to obtain the variable embedding of each variable;

[0066] S2, obtaining the correlation of all variables, selecting positively correlated and negatively correlated variable dependencies, and thus constructing a correlation diagram between positive and negative variables of a multivariate time series; the correlation diagram between positive and negative variables includes positive correlations and negative correlations;

[0067] S3, based on the correlation graph between positive and negative variables, obtains the attention coefficient, then combines the variable embedding of each variable with the historical data after linear transformation to obtain the information aggregation representation; and performs prediction based on the variable embedding and information aggregation representation to obtain the predicted value of each variable;

[0068] S4, calculate the error between the predicted value and the actual value of each variable, and obtain the time and variable related to the abnormality.

[0069] The above step S2 includes the following sub-steps:

[0070] S21, calculate the variable v i The variable embedding of the corresponding candidate relation variable v j The similarity of variable embeddings determines the variable v i dependencies;

[0071] S22, sort in descending order of similarity, and select several variables that are greater than the positive correlation threshold to form a positive correlation relationship;

[0072] S23, arranging in descending order of similarity, selecting a number of variables whose values are less than a negative correlation threshold to form a negative correlation relationship; the negative correlation threshold is less than a positive correlation threshold.

[0073] The above step S3 includes the following sub-steps:

[0074] S31, connecting the variable embedding of each variable with the corresponding variable historical data after linear transformation to obtain variable features;

[0075] S32, for any variable, according to the corresponding variable characteristics, the variable characteristics of the positively correlated neighbor variables or the negatively correlated neighbor variables, and the learning coefficient vector, through the activation function and regularization processing, obtain the positive correlation attention coefficient or the negative correlation attention coefficient of the corresponding variable;

[0076] S33, for any variable, based on its own attention coefficient, the positively correlated attention coefficient or the negatively correlated attention coefficient, and the corresponding variable historical data after linear transformation, obtain an aggregated representation of positively correlated neighbors or an aggregated representation of negatively correlated neighbors through aggregation; then aggregate the aggregated representation of positively correlated neighbors with the aggregated representation of negatively correlated neighbors to obtain an information aggregated representation;

[0077] S34, predicting the predicted value of each variable based on the result obtained by element-by-element multiplication of the variable embedding of each variable and the corresponding aggregate information representation.

[0078] Compared with existing technologies, the multivariate time series anomaly detection system and method based on positive and negative correlation graph deviations provided by the present invention has the following beneficial effects:

[0079] (1) By introducing the positive and negative correlation graph bias, the present invention solves the key limitation of the previous method that relies only on positive correlation, thereby being able to more accurately represent the dynamic dependency between variables, improving the system's anti-interference ability, further improving the time series anomaly detection performance, and effectively responding to anomaly detection needs in complex scenarios;

[0080] (2) This paper designs an attention mechanism that assigns different weights based on the neighbor information propagation strategy in the variable correlation graph and clearly separates the impact of positive and negative correlations; this innovative approach amplifies the prediction error, significantly enhances the system's ability to distinguish anomalies, and improves the effectiveness of anomaly detection in time series data;

[0081] (3) Extensive evaluation on two real industrial datasets demonstrates that our approach consistently outperforms baseline models in anomaly detection. Ablation studies and interpretability analysis further validate its effectiveness and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 Schematic diagram of the principle of the multivariate time series anomaly detection system based on positive and negative correlation graph deviations of the present invention;

[0083] Figure 2 Schematic diagram of the process of multivariate time series anomaly detection method based on positive and negative correlation graph deviations of the present invention;

[0084] Figure 3 Construct a flow chart for the correlation diagram between positive and negative variables;

[0085] Figure 4 Schematic diagram of information dissemination and prediction process;

[0086] Figure 5 A comparison chart of the prediction errors between using only positive correlation for anomaly detection and using both positive and negative correlation for anomaly detection.

[0087] Explanation of terms

[0088] A Graph Neural Network (GNN) is a deep learning model specifically designed for processing graph-structured data. Its main idea is to leverage the topology and node characteristics of a graph, propagating and aggregating information between nodes so that each node can fully utilize its own information and that of its neighbors, thereby learning its own new representation. This paper primarily uses a Graph Deviation Network (GDN).

[0089] The message-passing graph neural network (MPNN) describes the process of message propagation and aggregation in static graphs and can be considered a general framework for learning static graph representations. The entire network consists of two phases: message passing and readout. The message passing phase includes two core functions (message function / aggregation function and update function / combination function), whose main purpose is to learn the characteristics of nodes in the graph; the readout phase includes a core function (readout function), whose main purpose is to obtain the characteristics of the entire graph.

[0090] The LeakyReLU activation function is a rectified linear unit that maintains linearity in the non-negative part and introduces a small slope (usually a small positive number) in the negative part to prevent the gradient vanishing problem. The characteristic of LeakyReLU is its negative slope. In the training of neural networks, when the input value is negative, the ReLU function sets it to 0, which will cause the gradient to vanish. However, LeakyReLU allows a small number of negative values to pass through and gives them a small negative slope, thus avoiding the gradient vanishing problem. This helps the neural network better utilize the information in the negative area and improve the expressive power of the model. DETAILED DESCRIPTION

[0091] The present invention will be further described below with reference to the accompanying drawings.

[0092] Example

[0093] This embodiment provides a multivariate time series anomaly detection system based on positive and negative correlation graph deviation (Positive and Negative Correlation Graph Deviation Network, referred to as PNGDN), which includes a variable embedding module, a positive and negative variable correlation graph construction module, an information propagation and prediction module and an anomaly detector. Figure 1 Provide a detailed explanation of each module.

[0094] (1) Variable embedding module, which is used to embed each variable and obtain the variable embedding of each variable.

[0095] In this embodiment, a multi-dimensional embedding vector is introduced for each time series variable to represent the behavior of each variable, thereby capturing the "factors" behind its behavior. Each variable embedding is represented as vec i ∈R h After these embeddings are randomly initialized, they are trained with the rest of the system based on the multivariate data within each sliding window. Through training, the variable embedding vectors become part of the parameters of the graph neural network (GDN), enabling the system to better capture the specific properties of the variables and describe the unique behavioral representation of each variable.

[0096] (2) The module for constructing the correlation diagram between positive and negative variables is used to obtain the correlation of all variables, select the positive and negative correlation variable dependencies, and thus construct the correlation diagram between positive and negative variables of the multivariate time series. The correlation diagram between positive and negative variables includes positive correlation and negative correlation.

[0097] In this embodiment, G=(V, E) is used to represent the directed graph, where V={v1, v2, ..., v N} represents a variable node set, vi represents the i-th variable, N is the number of variables, E represents the edge set, and Respectively represent the variables v i to the variable v j The sets of directed positive and negative correlation edges between .

[0098] In this embodiment, the module for constructing the correlation diagram between positive and negative variables includes:

[0099] Candidate relationship building unit, used to calculate the variable v i The variable embedding of the corresponding candidate relation variable v j The similarity of variable embeddings determines the variable v i dependencies.

[0100] variable v i The candidate relation of is defined as all variables except itself, that is, P i ={v1,v2,......,v N}\{i}. To determine the variable v i Dependency relationship, calculate the variable v i Embedding vec i and P i The similarity e between the variable embeddings of each variable in j,i The similarity formula is defined as:

[0101]

[0102] The positive correlation building unit is used to arrange in descending order of similarity and select several variables that are greater than a positive correlation threshold to form a positive correlation.

[0103] For the variable v i , according to the set positive correlation threshold, select K + The variables with the largest similarity score are regarded as positively correlated neighbors, forming a positive correlation relationship. The positive correlation threshold can be selected according to the actual situation of the data set. i , its positively correlated neighbor node set can be expressed as V + (v i ). The formula for defining positively correlated neighbors is:

[0104]

[0105] The negative correlation relationship building unit is used to arrange in descending order of similarity and select several variables whose values are less than a negative correlation threshold to form a negative correlation relationship; the negative correlation threshold is less than a positive correlation threshold.

[0106] For variable node v i , according to the set negative correlation threshold, select K -The variables with the smallest similarity scores are regarded as negatively correlated neighbors, forming a negative correlation relationship. In order to avoid the influence of the relationship noise of irrelevant variables, the negative correlation threshold can be selected according to the actual situation of the data set. i , its negatively correlated neighbor node set can be expressed as V - (v i ). The formula for defining negatively correlated neighbors is:

[0107]

[0108] Positive and negative correlations together form the correlation graph between positive and negative variables.

[0109] (3) Information propagation and prediction module, which is used to obtain the attention coefficient based on the correlation diagram between positive and negative variables, and then aggregate the variable embedding of each variable and the historical data after linear transformation to obtain the information aggregation representation; and make predictions based on the variable embedding and information aggregation representation to obtain the predicted value of each variable.

[0110] In this embodiment, the information dissemination and prediction module includes:

[0111] The variable feature construction unit is used to connect the variable embedding of each variable with the corresponding variable historical data after linear transformation to obtain the variable feature.

[0112] Taking into account the unique attributes of each variable and combining the temporal and spatial characteristics of the time series, the variables obtained to characterize the corresponding behaviors of different variables are embedded into vec i and historical data after corresponding linear transformation Connect them to get the variable characteristics of the corresponding variables, and define the connection formula between the two as:

[0113]

[0114] Among them, x i is the historical window data of the i-th variable, W is the linear transformation weight of the time series, and the subscript t is omitted to simplify the formula.

[0115] The attention coefficient calculation unit is used to obtain the positive correlation attention coefficient or negative correlation attention coefficient of any variable through activation function and regularization processing based on the corresponding variable characteristics, the variable characteristics of the positively correlated neighbor or negatively correlated neighbor variables, and the learning coefficient vector.

[0116] Taking the calculation of positive correlation attention coefficient as an example, the calculation process is: the variable feature q i Variable characteristics q of positively correlated neighbor variables jThe addition result is processed together with the learning coefficient vector a used for the attention mechanism, and the positive correlation attention coefficient π(i, j) is calculated through the activation function LeakyReLU, and then the positive correlation attention coefficient is regularized to obtain the regularized positive correlation attention coefficient (expressed as ), the whole process can be expressed as:

[0117]

[0118] in, represents transpose, q j is the variable characteristic of the negatively correlated neighbor variable, vec j is the variable embedding of the jth negatively correlated neighbor variable, x j is the historical window data of the jth negatively correlated neighbor variable.

[0119] Using the same operation, the negative correlation attention coefficient can be calculated The whole process can be expressed as:

[0120]

[0121] Among them, q j′ is the variable characteristic of the negatively correlated neighbor variable, vec j′ is the variable embedding of the j′th negatively correlated neighbor variable, x j′ is the historical window data of the j′th negatively correlated neighbor variable.

[0122] The information aggregation representation generation unit is used to obtain the aggregate representation of positively correlated neighbors or the aggregate representation of negatively correlated neighbors for any variable based on its own attention coefficient, positively correlated attention coefficient or negatively correlated attention coefficient, and the historical data of the corresponding variable after linear transformation; and then aggregate the aggregate representation of positively correlated neighbors and the aggregate representation of negatively correlated neighbors to obtain the information aggregation representation.

[0123] Represented as an aggregation of positively correlated neighbors Taking generation as an example, the generation process can be expressed in the following form:

[0124]

[0125] Among them, α i,i For variable node v i Its own first regularized attention coefficient, For variable node v i For its positively correlated neighbor node v j Regularized positive correlation attention coefficient of x jis the historical window data of the jth positively correlated neighbor variable.

[0126] Using the same operation, we can generate an aggregate representation of negatively correlated neighbors The generation process can be expressed in the following form:

[0127]

[0128] in, For variable node v i Its own second regularized attention coefficient, For variable node v i For its negatively correlated neighbor node v j′ Regularized negative correlation attention coefficient, x j′ is the historical window data of the j'th negatively correlated neighbor variable.

[0129] Aggregate the information after positive and negative correlation propagation to obtain the variable v i Information aggregation representation Z i The corresponding mathematical expression of the whole process is:

[0130] Z i =z i + +z i - (11).

[0131] The prediction unit is used to predict the predicted value of each variable based on the result obtained by element-by-element multiplication of the variable embedding of each variable and the corresponding aggregate information representation.

[0132] Because Z i It is impossible to clearly distinguish the inherent properties of each variable. In order to bridge the gap between the variable representation and the intrinsic characteristics of each variable, a more accurate time series forecast value of each variable is obtained in the prediction unit. Here, the embedding vector of the specific variable is added, and the information aggregation representation {Z1, Z2, ..., Z N}, set the variable v i The corresponding variable embedding vector vec i Instead of element-wise multiplication, use the unique preferences of each variable to emphasize or suppress Z i The prediction unit is a stacked fully connected layer f with a hidden layer size h and an output dimension N. θ The prediction process formula is defined as:

[0133]

[0134] When training the fully connected layer, define the predicted output values of all variables and the observed true output value x t The mean square error between is used as the loss function during training, and the formula is as follows:

[0135]

[0136] Among them, T is the length of all time series in the training set, and L is the length of the input historical window time series data.

[0137] (4) Anomaly detector, which is used to calculate the error between the predicted value and the actual value of each variable and obtain the time and variable related to the anomaly.

[0138] The variable v is calculated by comparing the predicted value at time t with the actual value observed at time t. i The absolute error is Dev i,t To determine the anomaly score. In addition, given the different characteristics of different variables, the magnitude of their anomaly deviation may be different. In order to prevent the anomaly deviation of any single variable from masking other variables, the absolute error Dev of each variable is calculated. i,t Normalize. This process is shown in formulas (14)-(15):

[0139]

[0140] Among them, x i,t is the actual value of the i-th variable at time t, is the predicted value of the i-th variable at time t, Dev i,t is the absolute error of the i-th variable at time t. Compared with the mean and standard deviation, the median and quartile values are more robust to abnormal phenomena. Defined as the median absolute error, Defined as the absolute error quartile, d i (t) is the normalized result of the absolute error of the i-th variable.

[0141] Then, the total anomaly score at time t is calculated, and the anomaly deviations of all variables are aggregated using the maximum function to better highlight which variables have anomalies. The process is shown in formula (16). In order to prevent the sudden increase of normal data from causing excessive deviation of abnormal deviation, a simple moving average is selected to smooth the score and reduce the impact of spikes in normal data, where w is the smoothing window length, A s,t As the anomaly score. This process is formulated as:

[0142]

[0143] Among them, At-k is the maximum value obtained according to the normalized result of absolute error at time tk, that is, the maximum abnormal value at time tk, A t is the maximum abnormal value at time t (i.e. k = 0), A s,t is the overall anomaly score at time t.

[0144] Finally, the anomaly score A at time t s,t When the abnormal threshold is exceeded, the moment will be marked as abnormal. The abnormal threshold is set to the corresponding A calculated based on the validation set in different data sets. s,t Maximum value.

[0145] like Figure 2-Figure 4 As shown, this embodiment also provides a multivariate time series anomaly detection method based on positive and negative correlation graph deviation, using the above multivariate time series anomaly detection system, and following the steps below:

[0146] S1, embed each variable to obtain the variable embedding of each variable.

[0147] S2, obtaining the correlation of all variables, selecting positively correlated and negatively correlated variable dependencies, and thus constructing a correlation diagram between positive and negative variables of a multivariate time series; the correlation diagram between positive and negative variables includes positive correlations and negative correlations.

[0148] Step S2 includes the following sub-steps:

[0149] S21, calculate the variable v i The variable embedding of the corresponding candidate relation variable v j The similarity of variable embeddings determines the variable v i dependencies;

[0150] S22, sort in descending order of similarity, and select several variables that are greater than the positive correlation threshold to form a positive correlation relationship;

[0151] S23, arranging in descending order of similarity, selecting a number of variables whose values are less than a negative correlation threshold to form a negative correlation relationship; the negative correlation threshold is less than a positive correlation threshold.

[0152] S3, based on the correlation diagram between positive and negative variables, obtains the attention coefficient, and then combines the variable embedding of each variable and the historical data after linear transformation to obtain the information aggregation representation; and makes predictions based on the variable embedding and information aggregation representation to obtain the predicted value of each variable.

[0153] Step S3 includes the following sub-steps:

[0154] S31, connecting the variable embedding of each variable with the corresponding variable historical data after linear transformation to obtain variable features;

[0155] S32, for any variable, according to the corresponding variable characteristics, the variable characteristics of the positively correlated neighbor variables or the negatively correlated neighbor variables, and the learning coefficient vector, through the activation function and regularization processing, obtain the positive correlation attention coefficient or the negative correlation attention coefficient of the corresponding variable;

[0156] S33, for any variable, based on its own attention coefficient, the positively correlated attention coefficient or the negatively correlated attention coefficient, and the corresponding variable historical data after linear transformation, obtain an aggregated representation of positively correlated neighbors or an aggregated representation of negatively correlated neighbors through aggregation; then aggregate the aggregated representation of positively correlated neighbors with the aggregated representation of negatively correlated neighbors to obtain an information aggregated representation;

[0157] S34, predicting the predicted value of each variable based on the result obtained by element-by-element multiplication of the variable embedding of each variable and the corresponding aggregate information representation.

[0158] S4, calculate the error between the predicted value and the actual value of each variable, and obtain the time and variable related to the abnormality.

[0159] Application Examples

[0160] The multivariate time series anomaly detection system based on positive and negative correlation graph deviation provided in the embodiment is used to detect three different real data sets (Secure Water Treatment (SWaT) data set, Water Distribution (WADI) data set and Server Machine Dataset (SMD) data set. The source of SWaT data can be found in reference [Mathur AP, Tippenhauer N O. SWaT: A water treatment testbed for research and training on ICS security [C] / / 2016 international workshop on cyber-physical systems for smart water networks (CySWater). IEEE, 2016: 31-36.], the source of WADI data can be found in reference [Ahmed C M, Palleti VR, Mathur A P. WADI: a water distribution testbed for research in the design of secure cyber physical systems [C] / / Proceedings of the 3rd international workshop on cyber-physical systems for smart water networks. 2017: 25-28.], and the source of SMD data set can be found in reference [Su Y, Zhao Y, Niu C, et al. al.Robustanomaly detection for multivariate time series through stochastic recurrent neural network[C] / / Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery&data mining.2019:2828-2837.】, both SWaT and WADI datasets can be obtained from https: / / itrust.sutd.edu.sg / , and the latter can be obtained from the corresponding github of the paper: https: / / github.com / NetManAIOps / OmniAnomaly) to produce results respectively.All three datasets have designated training and test sets, so for each dataset, 30% of the training set is selected as the validation set and 70% is used for training; the anomaly rates in the test set are 12.21%, 5.82%, and 4.16%, respectively.

[0161] Because the cyber-physical systems (CPSs) used by SWaT and WADI require 5-6 hours to reach stability after startup, the 21,600 unstable data points within the first 5-6 hours corresponding to the training data in these two datasets were excluded. Furthermore, since the original sampling time points of the SWaT and WADI datasets are dense and the data volume is large, to reduce training time, the original data text is downsampled to a measurement every 10 seconds. The median value is selected as the processed data value. The resulting label is similarly the most common label within the 10-second period. The SMD dataset consists of multivariate time series data monitored from 28 servers over a 5-week period. Given that the data from all 28 servers was collected simultaneously, the model was trained and tested separately for each server. Performance metrics were aggregated by averaging the validation results across all servers to select the best model. This approach maintains statistical reliability while dynamically adjusting the anomaly detection framework to the operating conditions of different server environments, ensuring robustness and versatility.

[0162] The training and testing process of the entire PNGDN system is described as follows: First, the training set is used to obtain the predicted value of each variable according to the steps S1-S3 given above, and then the loss value is calculated according to the loss function given by formula (13); then, based on the loss value, the system parameters (including the embedding vector vec of each variable) are adjusted by the gradient descent algorithm. i , learning coefficient vector a, time series linear transformation weight W, full connection layer parameters, etc.) for optimization; repeat the above operation until the set upper limit of iterations is reached and the training ends; during the training process, the system effect can also be verified with the validation set; for the validation set of each data set, the maximum value A is calculated s,t As the anomaly threshold of the corresponding dataset, the trained multivariate time series anomaly detection system based on positive and negative correlation graph deviation is then used to test the test set.

[0163] This application example also presents the anomaly detection performance of different baseline models (AE, DAGMM, LSTM-VAE, MAD-GAN, GDN, and M2N2) on the two datasets mentioned above, as shown in Table 1. This application example uses precision (P), recall (R), and F1-score (F1-Score) as evaluation metrics to assess the effectiveness of this method and other baseline models (larger values for all three indicate better performance).

[0164] Table 1: Results of anomaly detection on two datasets

[0165]

[0166] The remaining methods in the table are described as follows:

[0167] AE (Autoencoders) consists of an encoder and a decoder, and is used to reconstruct data samples. This method uses the reconstruction error as an anomaly score. For its implementation, see [Aggarwal CC, Aggarwal C C. Outlier analysis [J]. Data Mining: The Textbook, 2015: 237-263].

[0168] DAGMM, short for Deep Autoencoding Gaussian Mixture Model, combines a deep autoencoder with a Gaussian mixture model to generate a low-dimensional representation and reconstruction error for each observation. Its implementation can be found in the paper [Zong B, Song Q, Min MR, et al. Deep autoencoding gaussian mixture model for unsupervised anomaly detection [C] / / International conference on learning representations. 2018].

[0169] LSTM-VAE: The full name is Long Short-Term Memory-based Variational Autoencoder. This method replaces the feedforward network in VAE with LSTM to model temporal dependencies and combines the distribution modeling capabilities of VAE to output reconstructed data. This method uses the reconstruction error as an anomaly score. For its implementation process, please refer to the literature [Park D, Hoshi Y, Kemp CC. A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder [J]. IEEE Robotics and Automation Letters, 2018, 3(3): 1544-1551].

[0170] MAD-GAN (Multivariate Anomaly Detection with GAN) combines the GAN and LSTM-RNN models. The GAN serves as a generator, trained on normal data to generate fake data. The LSTM-RNN discriminator improves the generator's performance by learning the differences between normal and generated data, making the generated data as close to real data as possible. The error between the generated and real data is used as an anomaly score. For details on its implementation, see [Li D, Chen D, Jin B, et al. MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks [C] / / International conference on artificial neural networks. Cham: Springer International Publishing, 2019: 703-716].

[0171] GDN: Graph Deviation Network. This method uses a method that combines graph neural networks and attention mechanisms to detect anomalies. By embedding vectors into sensors and building relationships between them, the method uses the graph attention mechanism to predict the future value of each sensor. The method uses the error between the predicted data and the actual data as an anomaly score and aggregates this score to locate anomalies. For its implementation process, please refer to the literature [Deng A, Hooi B. Graphneural network-based anomaly detection in multivariate time series [C] / / Proceedings of the AAAI conference on artificial intelligence. 2021, 35(5): 4027-4035].

[0172] M2N2: The full name is When Model Meets New Normals. In real-time monitoring scenarios, the cost of frequently acquiring historical data is very high, and anomalies are often rarely annotated. To address the distribution change problem under such constraints, this method proposes a simple and effective test-time adaptation strategy based on trend estimation, as well as a self-supervised model that learns new normals during inference. The implementation process can be found in the literature [Kim D, Park S, Choo J. When model meets new normals: test-time adaptation for unsupervised time-series anomaly detection [C] / / Proceedings of the AAAI conference on artificial intelligence. 2024, 38(12): 13113-13121].

[0173] It can be seen from the experimental results in Table 1 that the multivariate time series anomaly detection system based on positive and negative correlation graph deviation provided by the present invention can effectively improve the effect of anomaly detection compared with other baseline models.

[0174] In order to verify the impact of positive and negative correlation, this application example conducted an ablation experiment and interpretability analysis, and deleted the negative correlation and related operations in the multivariate time series anomaly detection system based on positive and negative correlation graph deviation provided in the embodiment, while other operations remained the same. The error prediction effect on the WADI dataset is shown in the attached figure. Figure 5 As shown in the figure, it can be seen that the GDN-based method (i.e., PGDN) that excludes negative correlation and only uses positive correlation lacks important relationship characteristics between variables, reduces the prediction error during abnormal periods, and weakens its effectiveness in detecting anomalies, making it unable to adapt to the anomaly detection needs in scenarios with complex relationships between variables.

[0175] As can be seen from the above, the multivariate time series anomaly detection system and method based on positive and negative correlation graph deviations provided by this invention overcomes the limitations of previous methods that rely solely on positive correlations by integrating variable embedding, an inter-variable correlation graph learning module, and an innovative attention-based information propagation mechanism. This dual-correlation approach not only achieves better anomaly detection results, but also improves model interpretability by explicitly modeling the contributions of positive and negative dependencies, effectively addressing the needs of anomaly detection in complex scenarios.

[0176] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in the present invention without departing from the essence of the present invention, and such variations and combinations are still within the scope of protection of the present invention.

Claims

1. A multivariate time series anomaly detection system based on positive and negative correlation graph deviation, characterized in that: include: The variable embedding module is used to embed each variable and obtain the variable embedding of each variable; A positive and negative variable correlation diagram construction module is used to obtain the correlation of all variables, select positively correlated and negatively correlated variable dependencies, and thus construct a positive and negative variable correlation diagram of a multivariate time series; the positive and negative variable correlation diagram includes positive and negative correlations; The information propagation and prediction module is used to obtain the attention coefficient based on the correlation diagram between positive and negative variables, and then aggregate the information to obtain the aggregated representation by combining the variable embedding of each variable and the historical data after linear transformation; And make predictions based on variable embedding and information aggregation representation to obtain the predicted values of each variable; Anomaly detector is used to calculate the error between the predicted value and the actual value of each variable and obtain the time and variable related to the anomaly.

2. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 1 is characterized in that: The positive and negative variable correlation diagram construction module includes: Candidate relationship building unit, used to calculate the variable v i The variable embedding of the corresponding candidate relation variable v j The similarity of variable embeddings determines the variable v i dependencies; A positive correlation building unit is used to sort in descending order of similarity and select several variables that are greater than a positive correlation threshold to form a positive correlation; The negative correlation relationship building unit is used to arrange in descending order of similarity and select several variables whose values are less than a negative correlation threshold to form a negative correlation relationship; the negative correlation threshold is less than a positive correlation threshold.

3. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 2 is characterized in that: For the correlation graph construction module between positive and negative variables, G = (N, E) is used to represent the directed graph, where V = {v1, v2, ..., v N } represents a variable node set, v i represents the i-th variable, N is the number of variables, E represents the edge set, and Respectively represent the variables v i to the variable v j The directed positive and negative correlation edge sets between ; In the candidate relationship construction unit, the variable v i The candidate relation of is defined as all variables except itself, that is, P i ={v1,v2,......,v N }\{i}; Calculate the variable v i The embedding vector vec i and P i The similarity e between the variable embeddings of each variable in j,i ; The similarity formula is defined as: The positive correlation building unit, for the variable v i , according to the set positive correlation threshold, select K + The variables with the largest similarity score are regarded as positively correlated neighbors, forming a positive correlation relationship; for variable v i , its positively correlated neighbor node set can be expressed as V + (v i ), the formula for defining positively correlated neighbors is: The negative correlation building unit, for the variable node v i , according to the set negative correlation threshold, select K - The variables with the smallest similarity scores are regarded as negatively correlated neighbors, forming a negative correlation relationship; for variable v i , its negatively correlated neighbor node set can be expressed as V - (v i ); The formula for defining negatively correlated neighbors is: Positive and negative correlations together form the correlation graph between positive and negative variables.

4. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to any one of claims 1 to 3, characterized in that: The information dissemination and prediction module includes: A variable feature construction unit is used to connect the variable embedding of each variable with the corresponding variable historical data after linear transformation to obtain the variable feature; An attention coefficient calculation unit is used to obtain the positive or negative attention coefficient of any variable based on the corresponding variable characteristics, the variable characteristics of the positively correlated neighbor variables or the negatively correlated neighbor variables, and the learning coefficient vector through activation function and regularization processing; An information aggregation representation generation unit is used to obtain, for any variable, an aggregate representation of positively correlated neighbors or an aggregate representation of negatively correlated neighbors by aggregating the variable's own attention coefficient, the positively correlated attention coefficient, or the negatively correlated attention coefficient, and the corresponding variable's historical data after linear transformation; and then aggregating the aggregate representation of positively correlated neighbors with the aggregate representation of negatively correlated neighbors to obtain an information aggregation representation; The prediction unit is used to predict the predicted value of each variable based on the result obtained by element-by-element multiplication of the variable embedding of each variable and the corresponding aggregate information representation.

5. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 4 is characterized in that: Variable feature construction unit, which embeds the variables used to characterize the corresponding behaviors of different variables into vec i and the historical window data after corresponding linear transformation Connect them to get the variable characteristics of the corresponding variables, and define the connection formula between the two as: Among them, x i is the historical window data of the i-th variable, and W is the linear transformation weight of the time series.

6. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 5, characterized in that: In the attention coefficient calculation unit, taking the positive correlation attention coefficient calculation as an example, the calculation process is: the variable feature q i Variable characteristics q of positively correlated neighbor variables j The addition result is processed together with the learning coefficient vector a used for the attention mechanism, and the positive correlation attention coefficient π(i, j) is calculated through the activation function LeakyReLU. The positive correlation attention coefficient is then regularized to obtain the regularized positive correlation attention coefficient, which is expressed as The whole process can be expressed as: in, represents transpose; Using the same operation, the negative correlation attention coefficient can be calculated The whole process can be expressed as: Among them, q j′ is the variable characteristic of the negatively correlated neighbor variable.

7. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 6, characterized in that: In the information aggregation representation generation unit, the aggregation representation of positively correlated neighbors is used Taking generation as an example, the generation process is expressed in the following form: Among them, α i,i For variable node v i Its own first regularized attention coefficient, x j is the historical window data of the jth positively correlated neighbor variable; Using the same operation, generate the aggregate representation of negatively correlated neighbors The generation process can be expressed in the following form: in, For variable node v i Its own second regularized attention coefficient, x j′ is the historical window data of the j'th negatively correlated neighbor variable; Aggregate the information after positive and negative correlation propagation to obtain the variable v i Information aggregation representation Z i The whole process is expressed as follows: WITH i =z i + +with i - 。 8. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 7 is characterized in that: In the prediction unit, information aggregation is used to represent {Z1, Z2, ..., Z N }, set the variable v i The corresponding variable embedding vec i Multiply it element-wise and use the result as the input of the prediction unit to predict the value of all variables at time t:

9. The multivariate time series anomaly detection system based on positive and negative correlation graph deviation according to claim 8, characterized in that: The anomaly detector calculates the variable v by comparing the predicted value at time t with the actual value observed at time t. i The absolute error of each variable at time t is normalized and the maximum value is taken and smoothed to obtain the abnormal score A at this time. s,t , the process is expressed as: Among them, x i,t is the actual value of the i-th variable at time t, is the predicted value of the i-th variable at time t, Dev i,t is the absolute error of the i-th variable at time t, Defined as the median absolute error, Defined as the absolute error quartile, d i (t) is the normalized result of the absolute error of the i-th variable, A t-k is the maximum abnormal value at time tk, A t is the maximum outlier at time t, A s,t is the anomaly score at time t.

10. A multivariate time series anomaly detection method based on positive and negative correlation graph deviation, characterized in that: The following steps are involved: S1, embed each variable to obtain the variable embedding of each variable; S2, obtaining the correlation of all variables, selecting positively correlated and negatively correlated variable dependencies, and thus constructing a correlation diagram between positive and negative variables of a multivariate time series; the correlation diagram between positive and negative variables includes positive correlations and negative correlations; S3, based on the correlation graph between positive and negative variables, obtains the attention coefficient, and then combines the variable embedding of each variable and the historical data after linear transformation to obtain the information aggregation representation; And make predictions based on variable embedding and information aggregation representation to obtain the predicted values of each variable; S4, calculate the error between the predicted value and the actual value of each variable, and obtain the time and variable related to the abnormality.

11. The multivariate time series anomaly detection method based on positive and negative correlation graph deviation according to claim 10, characterized in that: Step S2 includes the following sub-steps: S21, calculate the variable v i The variable embedding of the corresponding candidate relation variable v j The similarity of variable embeddings determines the variable v i dependencies; S22, sort in descending order of similarity, and select several variables that are greater than the positive correlation threshold to form a positive correlation relationship; S23, arranging in descending order of similarity, selecting a number of variables whose values are less than a negative correlation threshold to form a negative correlation relationship; the negative correlation threshold is less than a positive correlation threshold.

12. The multivariate time series anomaly detection method based on positive and negative correlation graph deviation according to claim 10, characterized in that: Step S3 includes the following sub-steps: S31, connecting the variable embedding of each variable with the corresponding variable historical data after linear transformation to obtain variable features; S32, for any variable, according to the corresponding variable characteristics, the variable characteristics of the positively correlated neighbor variables or the negatively correlated neighbor variables, and the learning coefficient vector, through the activation function and regularization processing, obtain the positive correlation attention coefficient or the negative correlation attention coefficient of the corresponding variable; S33, for any variable, based on its own attention coefficient, the positively correlated attention coefficient or the negatively correlated attention coefficient, and the corresponding variable historical data after linear transformation, obtain an aggregated representation of positively correlated neighbors or an aggregated representation of negatively correlated neighbors through aggregation; then aggregate the aggregated representation of positively correlated neighbors with the aggregated representation of negatively correlated neighbors to obtain an information aggregated representation; S34, predicting the predicted value of each variable based on the result obtained by element-by-element multiplication of the variable embedding of each variable and the corresponding aggregate information representation.

Images