Time series data anomaly detection method, device, equipment and storage medium

Abstract

The present invention relates to the field of base frame operation and maintenance, and discloses a method, device, equipment and storage medium for detecting anomalies in time series data. The method comprises: collecting time series data to be detected, and extracting sub-time series data of fixed time length through a preset sliding time window; calling a preset Gram angular field algorithm, performing 2D conversion on the sub-time series data, and obtaining a first time series angular field matrix; inputting the first time series angular field matrix into a preset time series reconstruction model to reconstruct the time series data, and obtaining a second time series angular field matrix; calling a preset loss function, calculating the loss value of the first time series angular field matrix and the second time series angular field matrix, and judging whether the loss value exceeds the preset loss threshold; if so, determining that the sub-time series data is abnormal. The present invention utilizes the dependency information between time series to reconstruct the time series, thereby improving the accuracy of anomaly detection.

Description

Technical Field

[0001] The present invention relates to the field of base frame operation and maintenance, and in particular to a time series data anomaly detection method, device, equipment and storage medium. Background Art

[0002] Time series refers to a sequence formed by arranging the values ​​of a statistical indicator in a certain field at different times in chronological order. Time series data anomaly detection has always been a concern of academia and industry. Time series data anomaly detection is often used in scenarios such as operation and maintenance monitoring and traffic management. It detects the time series of monitoring indicators and issues timely alarms for any anomalies found to prompt staff to pay attention and handle them.

[0003] Traditional time series detection generally uses a sliding window to count important information in time data, such as the mean, median, etc., and then predicts the value at the next time point based on this key information. It is determined whether the time series is abnormal based on the predicted value and the actual value in the time series. When faced with a long time series, the traditional time series detection method has a large error in the detection results. Summary of the invention

[0004] The main purpose of the present invention is to solve the technical problem that the detection error of time series data anomaly is large and the detection accuracy is low.

[0005] A first aspect of the present invention provides a time series data anomaly detection method, the time series data anomaly detection method comprising:

[0006] Collect the time series data to be detected, and extract sub-time series data of fixed time length through a preset sliding time window;

[0007] Calling a preset Gram angular field algorithm to perform 2D conversion on the sub-time series data to obtain a first time series angular field matrix;

[0008] Inputting the first time series angle field matrix into a preset time series reconstruction model to reconstruct time series data to obtain a second time series angle field matrix;

[0009] Calling a preset loss function, calculating loss values ​​of the first time series angular field matrix and the second time series angular field matrix, and determining whether the loss values ​​exceed a preset loss threshold;

[0010] If so, it is determined that the sub-time series data is abnormal.

[0011] Optionally, in a first implementation of the first aspect of the present invention, the time series reconstruction model includes an encoder and a decoder, wherein the encoder is composed of multiple layers of one-dimensional convolutional layers and pooling layers, and the decoder is composed of multiple layers of one-dimensional deconvolutional layers and convolutional layers, and before the time series data to be detected is collected, it also includes:

[0012] Collecting time series data without abnormalities, and extracting sub-time series data without abnormalities of a fixed time length through the sliding time window;

[0013] Calling a preset Gram angular field algorithm to perform 2D conversion on the abnormal sub-time series data to obtain a third time series angular field matrix;

[0014] Inputting the third time series angle field matrix into the multi-layer one-dimensional convolutional layer for convolution operation to obtain a first feature matrix;

[0015] Inputting the first feature matrix into the pooling layer for mean encoding to obtain a first encoding matrix;

[0016] Inputting the first encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a first conversion matrix;

[0017] Inputting the first conversion matrix into the convolutional layer for feature reconstruction to obtain a fourth time series angular field matrix;

[0018] Calling a preset loss function to calculate loss values ​​of the third time series angular field matrix and the fourth time series angular field matrix;

[0019] According to the loss value, a preset optimization algorithm is called to optimize the parameters of the encoder and the decoder until the encoder and the decoder converge to obtain a timing reconstruction model.

[0020] Optionally, in a second implementation of the first aspect of the present invention, calling a preset optimization algorithm to perform parameter optimization on the encoder and the decoder according to the loss value until the encoder and the decoder converge, and obtaining the timing reconstruction model includes:

[0021] According to the loss value, calling a preset optimization algorithm to calculate the first-order moment estimate and the second-order moment estimate of the encoder and the decoder;

[0022] The first-order moment estimate and the second-order moment estimate are corrected, and parameters are updated using the corrected first-order moment estimate and the second-order moment estimate until the encoder and the decoder converge to obtain a timing reconstruction model.

[0023] Optionally, in a third implementation manner of the first aspect of the present invention, the collecting the time series data to be detected and extracting sub-time series data of a fixed time length through the sliding time window includes:

[0024] Collecting time series data to be detected, and adjusting the window length of the sliding time window;

[0025] Through the adjusted sliding time window, time series acquisition values ​​of a fixed time length are acquired forward every preset fixed time to obtain sub-time series data of the time series data to be detected.

[0026] Optionally, in a fourth implementation of the first aspect of the present invention, calling a preset Gram angular field algorithm to perform a 2D conversion on the sub-time series data to obtain a first time series angular field matrix includes:

[0027] Normalizing the time series values ​​in the sub-time series data to obtain normalized time series data;

[0028] Performing polar coordinate conversion on the normalized time series data to obtain polar coordinate time series data;

[0029] A plurality of time stamp corresponding values ​​in the polar coordinate time series data are intercepted, and a trigonometric function transformation is performed on each of the time stamp corresponding values ​​to obtain a first time series angular field matrix.

[0030] Optionally, in a fifth implementation of the first aspect of the present invention, inputting the first time series angular field matrix into a preset time series reconstruction model to reconstruct the time series data to obtain a second time series angular field matrix includes:

[0031] Inputting the first time-series angular field matrix into the multi-layer one-dimensional convolutional layer for convolution operation to obtain a second feature matrix;

[0032] Inputting the second feature matrix into the pooling layer for mean encoding to obtain a second encoding matrix;

[0033] Inputting the second encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a second conversion matrix;

[0034] The second conversion matrix is ​​input into the convolution layer for feature reconstruction to obtain a second time series angular field matrix.

[0035] Optionally, in a sixth implementation manner of the first aspect of the present invention, calling a preset loss function to calculate the loss values ​​of the first time series angular field matrix and the second time series angular field matrix includes:

[0036] Calculating matrix element errors at corresponding positions in the first timing angular field matrix and the second timing angular field matrix to obtain a plurality of matrix element error values;

[0037] Calling a preset loss function to calculate the sum of squares of the error values ​​of each matrix element;

[0038] The average value of the sum of squares of the error values ​​of the matrix elements is calculated to obtain the loss values ​​of the first timing angular field matrix and the second timing angular field matrix.

[0039] A second aspect of the present invention provides a time series data anomaly detection device, the time series data anomaly detection device comprising:

[0040] The acquisition module is used to acquire the time series data to be detected and extract sub-time series data of a fixed time length through a preset sliding time window;

[0041] A 2D conversion module, used for calling a preset Gram angular field algorithm to perform a 2D conversion on the sub-time series data to obtain a first time series angular field matrix;

[0042] A timing reconstruction module, used for inputting the first timing angular field matrix into a preset timing reconstruction model to reconstruct the timing data, so as to obtain a second timing angular field matrix;

[0043] A judgment module, used to call a preset loss function, calculate the loss value of the first time series angle field matrix and the second time series angle field matrix, and judge whether the loss value exceeds a preset loss threshold;

[0044] The output module is used to determine that an abnormality exists in the sub-time series data if the loss value exceeds the loss threshold.

[0045] Optionally, in a first implementation of the second aspect of the present invention, the time series reconstruction model includes an encoder and a decoder, wherein the encoder is composed of multiple layers of one-dimensional convolutional layers and pooling layers, the decoder is composed of multiple layers of one-dimensional deconvolutional layers and convolutional layers, and the time series data anomaly detection device further includes:

[0046] A sample processing module is used to collect time series data without abnormalities, and extract sub-time series data without abnormalities of a fixed time length through the sliding time window; call a preset Gram angular field algorithm to perform 2D conversion on the sub-time series data without abnormalities to obtain a third time series angular field matrix;

[0047] A model training module is used to input the third time series angular field matrix into the multi-layer one-dimensional convolution layer for convolution operation to obtain a first feature matrix; input the first feature matrix into the pooling layer for mean encoding to obtain a first encoding matrix; input the first encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a first conversion matrix; input the first conversion matrix into the convolution layer for feature reconstruction to obtain a fourth time series angular field matrix; call a preset loss function to calculate the loss value of the third time series angular field matrix and the fourth time series angular field matrix;

[0048] The model optimization module is used to call a preset optimization algorithm to optimize the parameters of the encoder and the decoder according to the loss value until the encoder and the decoder converge to obtain a timing reconstruction model.

[0049] Optionally, in a second implementation of the second aspect of the present invention, the model optimization module is specifically used to:

[0050] According to the loss value, calling a preset optimization algorithm to calculate the first-order moment estimate and the second-order moment estimate of the encoder and the decoder;

[0051] The first-order moment estimate and the second-order moment estimate are corrected, and parameters are updated using the corrected first-order moment estimate and the second-order moment estimate until the encoder and the decoder converge to obtain a timing reconstruction model.

[0052] Optionally, in a third implementation of the second aspect of the present invention, the acquisition module is specifically used to:

[0053] Collecting time series data to be detected, and adjusting the window length of the sliding time window;

[0054] Through the adjusted sliding time window, time series acquisition values ​​of a fixed time length are acquired forward every preset fixed time to obtain sub-time series data of the time series data to be detected.

[0055] Optionally, in a fourth implementation of the second aspect of the present invention, the 2D conversion module is specifically used to:

[0056] Normalizing the time series values ​​in the sub-time series data to obtain normalized time series data;

[0057] Performing polar coordinate conversion on the normalized time series data to obtain polar coordinate time series data;

[0058] A plurality of time stamp corresponding values ​​in the polar coordinate time series data are intercepted, and a trigonometric function transformation is performed on each of the time stamp corresponding values ​​to obtain a first time series angular field matrix.

[0059] Optionally, in a fifth implementation of the second aspect of the present invention, the timing reconstruction module is specifically used to:

[0060] Inputting the first time-series angular field matrix into the multi-layer one-dimensional convolutional layer for convolution operation to obtain a second feature matrix;

[0061] Inputting the second feature matrix into the pooling layer for mean encoding to obtain a second encoding matrix;

[0062] Inputting the second encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a second conversion matrix;

[0063] The second conversion matrix is ​​input into the convolution layer for feature reconstruction to obtain a second time series angular field matrix.

[0064] Optionally, in a sixth implementation of the second aspect of the present invention, the judgment module is specifically used to:

[0065] Calculating matrix element errors at corresponding positions in the first timing angular field matrix and the second timing angular field matrix to obtain a plurality of matrix element error values;

[0066] Calling a preset loss function to calculate the sum of squares of the error values ​​of each matrix element;

[0067] The average value of the sum of squares of the error values ​​of the matrix elements is calculated to obtain the loss values ​​of the first timing angular field matrix and the second timing angular field matrix.

[0068] The third aspect of the present invention provides a time series data anomaly detection device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the time series data anomaly detection device executes the above-mentioned time series data anomaly detection method.

[0069] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned method for detecting anomalies in time series data.

[0070] In the technical solution provided by the present invention, by combining the 2Dization of time series with the time series reconstruction model for anomaly detection, it is possible to perform calculation detection according to the input time series and identify the moment when anomalies exist, specifically: collect the time series data to be detected, and extract the sub-time series data of a fixed time length through a preset sliding time window. The present invention collects longer time series to help input more information into the model; call the preset Gram angular field algorithm to convert the sub-time series data into a 2D time series angular field matrix, and the dependency information of the time series in the time series data can be obtained through 2Dization; input the 2D time series angular field matrix into the preset time series reconstruction model to reconstruct the time series data, and obtain the reconstructed time series angular field matrix. The time series reconstruction model has a good reconstruction ability for time series without abnormalities, but the loss value of reconstructing abnormal time series is too large, so the model is used for time series reconstruction, and the time series data with a loss value greater than a preset threshold is judged as abnormal. The present invention reconstructs the time series dependency information, thereby improving the accuracy of abnormal detection of time series data. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is a schematic diagram of a first embodiment of a method for detecting anomalies in time series data according to an embodiment of the present invention;

[0072] Figure 2 Schematic diagram of a second embodiment of a method for detecting anomalies in time series data according to an embodiment of the present invention;

[0073] Figure 3 Schematic diagram of a third embodiment of the method for detecting anomalies in time series data according to an embodiment of the present invention;

[0074] Figure 4 This is a schematic diagram of a first embodiment of a time series data anomaly detection device according to an embodiment of the present invention;

[0075] Figure 5 This is a schematic diagram of a second embodiment of a time series data anomaly detection device according to an embodiment of the present invention;

[0076] Figure 6 Schematic diagram of an embodiment of a time series data anomaly detection device in an embodiment of the present invention. DETAILED DESCRIPTION

[0077] Embodiments of the present invention provide a method, apparatus, device and storage medium for detecting anomalies in time series data. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0078] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 The first embodiment of the time series data anomaly detection method in the embodiment of the present invention includes:

[0079] 101. Collect time series data to be detected, and extract sub-time series data of a fixed time length through a preset sliding time window;

[0080] It is understandable that the execution subject of the present invention may be a time series data anomaly detection device, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0081] In this embodiment, the time series data generated by various monitoring indicator data in the monitoring system and having a high correlation with time are used as the data to be detected. This embodiment also adds longer time series information and takes a time series with a length of 3N (extended forward by 2N length) as input.

[0082] Optionally, in one embodiment, the collecting the time series data to be detected and extracting sub-time series data of a fixed time length through the sliding time window includes:

[0083] Collecting time series data to be detected, and adjusting the window length of the sliding time window;

[0084] Through the adjusted sliding time window, time series acquisition values ​​of a fixed time length are acquired forward every preset fixed time to obtain sub-time series data of the time series data to be detected.

[0085] In this embodiment, the sliding time window is adjusted to a certain length. For example, if the time series acquisition granularity is 1 minute and the acquisition duration is 60 minutes, the length is 60 (including 60 acquisition values), and then extended forward by 2*60 lengths to obtain time series data of 3*60 lengths.

[0086] 102. Calling a preset Gram angular field algorithm to perform 2D conversion on the sub-time series data to obtain a first time series angular field matrix;

[0087] In this embodiment, the Gram angular field algorithm is used to measure the characteristics of each dimension and the relationship between each dimension. In the multi-scale matrix obtained after the inner product, the diagonal elements provide information about different feature graphs, and the remaining elements provide related information between different feature graphs. The obtained time series angular field matrix can not only reflect what features there are, but also reflect the closeness between different features.

[0088] 103. Input the first time series angular field matrix into a preset time series reconstruction model to reconstruct time series data to obtain a second time series angular field matrix;

[0089] In this embodiment, the time series reconstruction model includes an encoder and a decoder, wherein the encoder is composed of multiple layers of one-dimensional convolutional layers and pooling layers, and the decoder is composed of multiple layers of one-dimensional deconvolutional layers and convolutional layers. The one-dimensional convolutional layer compresses the input data, for example: the input data dimension is 8, the filter dimension is 5, and the data dimension output after convolution is 8-5+1=4. The main function of the pooling layer is to downsample and then reduce the dimension, remove redundant information, compress features, simplify network complexity, reduce the amount of calculation, and reduce memory consumption. The function of the one-dimensional deconvolution layer is to restore the compressed matrix, for example: a deconvolution output with a step size of 2 and a size of 3 is twice the number of inputs, and the coefficient becomes 4. The convolution layer outputs a second time series angular field matrix of [N, 3N].

[0090] Optionally, in one embodiment, inputting the first timing angle field matrix into a preset timing reconstruction model to reconstruct timing data to obtain a second timing angle field matrix includes:

[0091] Input the first temporal angular field matrix into the multi-layer one-dimensional convolutional layer for convolutional operation to obtain a second feature matrix;

[0092] Input the second feature matrix into the pooling layer for mean encoding to obtain a second encoding matrix;

[0093] Input the second encoding matrix into the multi-layer one-dimensional transposed convolutional layer for feature transformation to obtain a second transformation matrix;

[0094] Input the second transformation matrix into the convolutional layer for feature reconstruction to obtain a second temporal angular field matrix.

[0095] In this embodiment, the encoder includes a multi-layer one-dimensional convolutional layer and a pooling layer, encodes the first temporal angular field matrix with dimensions [N, 3N] into x1 with dimensions [L, C], and then decodes x1 through a decoder (including a multi-layer one-dimensional transposed convolutional layer and a convolutional layer) into a second temporal angular field matrix with dimensions [N, 3N]. L and C are the dimensions after the encoder compresses the length and increases the dimension, that is, L < N and C > 3N.

[0096] 104. Invoke a preset loss function, calculate the loss value between the first temporal angular field matrix and the second temporal angular field matrix, and determine whether the loss value exceeds a preset loss threshold;

[0097] In this embodiment, the loss function used is MSE, and it is determined whether there are anomalies in the temporal data by calculating the mean variance of the 2D temporal angular field matrix and the reconstructed temporal angular field matrix.

[0098] Optionally, in one embodiment, the invoking of the preset loss function and calculating the loss value between the first temporal angular field matrix and the second temporal angular field matrix includes:

[0099] Calculate the matrix element errors at the corresponding positions in the first temporal angular field matrix and the second temporal angular field matrix to obtain a plurality of matrix element error values;

[0100] Invoke the preset loss function to calculate the sum of the squares of the matrix element error values;

[0101] Calculate the average value of the sum of the squares of the matrix element error values to obtain the loss value between the first temporal angular field matrix and the second temporal angular field matrix.

[0102] In this embodiment, the loss function is:

[0103]

[0104] Wherein, MSE represents mean square error, n represents n elements in the matrix, x represents the matrix element value in the second time series angular field matrix, and x' represents the matrix element value in the first time series angular field matrix.

[0105] 105. If so, determine that the sub-time series data is abnormal.

[0106] In this embodiment, if the loss value exceeds the preset loss threshold, it is determined that the sub-time series data is abnormal, and the operation and maintenance system discovers the relevant abnormality and issues a warning in a timely manner.

[0107] The embodiment of the present invention combines the 2Dization of time series with the time series reconstruction model for anomaly detection, can perform calculation detection according to the input time series, and identify the moment when anomalies exist, specifically: collect the time series data to be detected, and extract the sub-time series data of fixed time length through the preset sliding time window. The present invention collects longer time series to help input more information into the model; call the preset Gram angular field algorithm to convert the sub-time series data into a 2D time series angular field matrix, and the dependency information of the time series in the time series data can be obtained through 2Dization; input the 2D time series angular field matrix into the preset time series reconstruction model to reconstruct the time series data, and obtain the reconstructed time series angular field matrix. The time series reconstruction model has a good reconstruction ability for time series without abnormalities, but the loss value of reconstructing abnormal time series is too large, so the model is used for time series reconstruction, and the time series data with a loss value greater than the preset threshold is judged as abnormal. The present invention reconstructs the time series dependency information, thereby improving the accuracy of anomaly detection of time series data.

[0108] See also Figure 2 , a second embodiment of the time series data anomaly detection method in an embodiment of the present invention includes:

[0109] 201. Collect time series data without abnormalities, and extract sub-time series data without abnormalities of a fixed time length through the sliding time window;

[0110] 202. Calling a preset Gram angular field algorithm to perform 2D conversion on the abnormal sub-time series data to obtain a third time series angular field matrix;

[0111] 203. Input the third time series angular field matrix into the multi-layer one-dimensional convolution layer to perform convolution operation to obtain a first feature matrix;

[0112] 204. Input the first feature matrix into the pooling layer for mean encoding to obtain a first encoding matrix;

[0113] 205. Input the first encoding matrix into the multi-layer one-dimensional deconvolution layer to perform feature conversion to obtain a first conversion matrix;

[0114] 206. Input the first conversion matrix into the convolution layer for feature reconstruction to obtain a fourth time series angular field matrix;

[0115] 207. Calling a preset loss function to calculate loss values ​​of the third time series angular field matrix and the fourth time series angular field matrix;

[0116] In this embodiment, the loss function is:

[0117]

[0118] Wherein, MSE represents mean square error, n represents n elements in the matrix, y represents the matrix element value in the fourth time series angular field matrix, and y' represents the matrix element value in the third time series angular field matrix.

[0119] 208. According to the loss value, call a preset optimization algorithm to optimize parameters of the encoder and the decoder until the encoder and the decoder converge to obtain a time series reconstruction model;

[0120] Optionally, in one embodiment, calling a preset optimization algorithm to optimize parameters of the encoder and the decoder according to the loss value until the encoder and the decoder converge to obtain a timing reconstruction model includes:

[0121] According to the loss value, calling a preset optimization algorithm to calculate the first-order moment estimate and the second-order moment estimate of the encoder and the decoder;

[0122] The first-order moment estimate and the second-order moment estimate are corrected, and parameters are updated using the corrected first-order moment estimate and the second-order moment estimate until the encoder and the decoder converge to obtain a timing reconstruction model.

[0123] In this embodiment, the optimization algorithm adopts the Adam optimization algorithm. The Adam optimization algorithm calculates the adaptive learning rate of different parameters from the budget of the first and second moments of the gradient. The execution process of the Adam algorithm is as follows:

[0124] Solve for the first moment estimate of the gradient V dW 、V db and the second-order moment estimate S dW , S db :

[0125] V dW :=β1V dW +(1-β1)dW;

[0126] V db :=β1V db +(1-β1)db;

[0127] SdW :=β2S dW +(1-β2)dW 2 ;

[0128] S db :=β2S db +(1-β2)db 2 ;

[0129] Among them, β1 and β2 are the exponential decay rates of the first-order and second-order moment estimates, the matrices V and S on the right are the moment estimates of the previous iteration, and the symbol ":=" represents the assignment operation. Correct the first-order moment estimate and the second-order moment estimate, and update the parameters through the corrected moment estimate. Determine whether the accuracy of the training model meets the requirements. If it does, the trained network model is output as the time series reconstruction model; otherwise, the network training is repeated until the training model converges to obtain the time series reconstruction model.

[0130] 209. Collect the time series data to be detected, and extract sub-time series data of a fixed time length through a preset sliding time window;

[0131] 210. Call a preset Gram angular field algorithm to perform 2D conversion on the sub-time series data to obtain a first time series angular field matrix;

[0132] 211. Input the first time series angle field matrix into a preset time series reconstruction model to reconstruct time series data to obtain a second time series angle field matrix;

[0133] 212. Call a preset loss function to calculate loss values ​​of the first time series angular field matrix and the second time series angular field matrix, and determine whether the loss values ​​exceed a preset loss threshold;

[0134] 213. If so, determine that the sub-time series data is abnormal.

[0135] In the embodiment of the present invention, the time series reconstruction model is trained with time series data without abnormalities, so that the time series reconstruction model has a better reconstruction effect on time series data without abnormalities. However, since it has not been trained with abnormal data, it is unable to reconstruct abnormal time series and causes the loss value to be too large. Based on this principle, the model is used for time series reconstruction, and samples with loss values ​​greater than a preset threshold are judged as abnormal. The present invention reconstructs the time series matrix and then judges the difference with the input matrix, which greatly improves the accuracy of abnormality detection.

[0136] See also Figure 3 A third embodiment of the time series data anomaly detection method in the embodiment of the present invention includes:

[0137] 301. Collect time series data to be detected, and extract sub-time series data of a fixed time length through a preset sliding time window;

[0138] 302. Normalize the time series values ​​in the sub-time series data to obtain normalized time series data;

[0139] 303. Perform polar coordinate conversion on the normalized time series data to obtain polar coordinate time series data;

[0140] 304. intercepting a plurality of time stamp corresponding values ​​in the polar coordinate time series data, and performing trigonometric function transformation on the respective time stamp corresponding values ​​to obtain a first time series angular field matrix;

[0141] In this embodiment, the Gram angular field algorithm, for a time series of length N, quantifies the angular relationship between any two timestamps in the input time series through the Gram matrix, thereby obtaining an N*N matrix. Using the Gram angular field algorithm for 2D, the time series of length N is directly substituted into the generated N*N matrix, and then substituted into the time series reconstruction model. In order to add longer time series information, this embodiment takes a time series of length 3N (extending forward 2N length) and substitutes it. After generating a 3N*3N matrix, only the corresponding values ​​of the last N timestamps are intercepted, that is, an N*3N matrix. The calculation process can be summarized as follows:

[0142] x = GAF(t)[-N:];

[0143] Among them, t is a time series with a length of 3N, and x is a 2D matrix of [N, 3N], which is then used to detect anomalies of the last N timestamps.

[0144] 305. Input the first time series angular field matrix into a preset time series reconstruction model to reconstruct time series data to obtain a second time series angular field matrix;

[0145] 306. Call a preset loss function to calculate loss values ​​of the first time series angular field matrix and the second time series angular field matrix, and determine whether the loss values ​​exceed a preset loss threshold;

[0146] 307. If yes, determine that the sub-time series data is abnormal.

[0147] In the embodiment of the present invention, after the time series data is converted to 2D by the Gram angular field algorithm, the dimension is expanded and the original spatial information of the data is enhanced. At the same time, because its format is highly correlated with time, more dependency information between time series can be obtained, which solves the problem of low recognition rate of time series data with longer sequences by commonly used anomaly detection methods.

[0148] The above describes the time series data anomaly detection method in the embodiment of the present invention. The following describes the time series data anomaly detection device in the embodiment of the present invention. Figure 4The first embodiment of the time series data anomaly detection device in the embodiment of the present invention includes:

[0149] The acquisition module 401 is used to acquire the time series data to be detected and extract sub-time series data of a fixed time length through a preset sliding time window;

[0150] A 2D conversion module 402 is used to call a preset Gram angular field algorithm to perform a 2D conversion on the sub-time series data to obtain a first time series angular field matrix;

[0151] A timing reconstruction module 403 is used to input the first timing angle field matrix into a preset timing reconstruction model to reconstruct the timing data to obtain a second timing angle field matrix;

[0152] A judgment module 404 is used to call a preset loss function, calculate the loss value of the first time series angle field matrix and the second time series angle field matrix, and judge whether the loss value exceeds a preset loss threshold;

[0153] The output module 405 is used to determine that an abnormality exists in the sub-time series data if the loss value exceeds the loss threshold.

[0154] See also Figure 5 The second embodiment of the time series data anomaly detection device in the embodiment of the present invention includes:

[0155] The acquisition module 401 is used to acquire the time series data to be detected and extract sub-time series data of a fixed time length through a preset sliding time window;

[0156] A 2D conversion module 402 is used to call a preset Gram angular field algorithm to perform a 2D conversion on the sub-time series data to obtain a first time series angular field matrix;

[0157] A timing reconstruction module 403 is used to input the first timing angle field matrix into a preset timing reconstruction model to reconstruct the timing data to obtain a second timing angle field matrix;

[0158] A judgment module 404 is used to call a preset loss function, calculate the loss value of the first time series angle field matrix and the second time series angle field matrix, and judge whether the loss value exceeds a preset loss threshold;

[0159] The output module 405 is used to determine that an abnormality exists in the sub-time series data if the loss value exceeds the loss threshold.

[0160] Optionally, in one embodiment, the time series reconstruction model includes an encoder and a decoder, wherein the encoder is composed of multiple layers of one-dimensional convolutional layers and pooling layers, and the decoder is composed of multiple layers of one-dimensional deconvolutional layers and convolutional layers, and the time series data anomaly detection device further includes:

[0161] The sample processing module 406 is used to collect time series data without abnormalities, and extract sub-time series data without abnormalities of a fixed time length through the sliding time window; call the preset Gram angular field algorithm to perform 2D conversion on the sub-time series data without abnormalities to obtain a third time series angular field matrix;

[0162] The model training module 407 is used to input the third time series angular field matrix into the multi-layer one-dimensional convolution layer for convolution operation to obtain a first feature matrix; input the first feature matrix into the pooling layer for mean encoding to obtain a first encoding matrix; input the first encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a first conversion matrix; input the first conversion matrix into the convolution layer for feature reconstruction to obtain a fourth time series angular field matrix; call a preset loss function to calculate the loss value of the third time series angular field matrix and the fourth time series angular field matrix;

[0163] The model optimization module 408 is used to call a preset optimization algorithm to optimize the parameters of the encoder and the decoder according to the loss value until the encoder and the decoder converge to obtain a timing reconstruction model.

[0164] Optionally, in one embodiment, the model optimization module 408 is specifically used to:

[0165] According to the loss value, calling a preset optimization algorithm to calculate the first-order moment estimate and the second-order moment estimate of the encoder and the decoder;

[0166] The first-order moment estimate and the second-order moment estimate are corrected, and parameters are updated using the corrected first-order moment estimate and the second-order moment estimate until the encoder and the decoder converge to obtain a timing reconstruction model.

[0167] Optionally, in one embodiment, the acquisition module 401 is specifically used for:

[0168] Collecting time series data to be detected, and adjusting the window length of the sliding time window;

[0169] Through the adjusted sliding time window, time series acquisition values ​​of a fixed time length are acquired forward every preset fixed time to obtain sub-time series data of the time series data to be detected.

[0170] Optionally, in one embodiment, the 2D conversion module 402 is specifically used for:

[0171] Normalizing the time series values ​​in the sub-time series data to obtain normalized time series data;

[0172] Performing polar coordinate conversion on the normalized time series data to obtain polar coordinate time series data;

[0173] A plurality of time stamp corresponding values ​​in the polar coordinate time series data are intercepted, and a trigonometric function transformation is performed on each of the time stamp corresponding values ​​to obtain a first time series angular field matrix.

[0174] Optionally, in one embodiment, the timing reconstruction module 403 is specifically used to:

[0175] Inputting the first time-series angular field matrix into the multi-layer one-dimensional convolutional layer for convolution operation to obtain a second feature matrix;

[0176] Inputting the second feature matrix into the pooling layer for mean encoding to obtain a second encoding matrix;

[0177] Inputting the second encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a second conversion matrix;

[0178] The second conversion matrix is ​​input into the convolution layer for feature reconstruction to obtain a second time series angular field matrix.

[0179] Optionally, in one embodiment, the determining module 404 is specifically configured to:

[0180] Calculating matrix element errors at corresponding positions in the first timing angular field matrix and the second timing angular field matrix to obtain a plurality of matrix element error values;

[0181] Calling a preset loss function to calculate the sum of squares of the error values ​​of each matrix element;

[0182] The average value of the sum of squares of the error values ​​of the matrix elements is calculated to obtain the loss values ​​of the first timing angular field matrix and the second timing angular field matrix.

[0183] The embodiment of the present invention combines the 2Dization of time series with the time series reconstruction model for anomaly detection, can perform calculation detection according to the input time series, and identify the moment when anomalies exist, specifically: collect the time series data to be detected, and extract the sub-time series data of fixed time length through the preset sliding time window. The present invention collects longer time series to help input more information into the model; call the preset Gram angular field algorithm to convert the sub-time series data into a 2D time series angular field matrix, and the dependency information of the time series in the time series data can be obtained through 2Dization; input the 2D time series angular field matrix into the preset time series reconstruction model to reconstruct the time series data, and obtain the reconstructed time series angular field matrix. The time series reconstruction model has a good reconstruction ability for time series without abnormalities, but the loss value of reconstructing abnormal time series is too large, so the model is used for time series reconstruction, and the time series data with a loss value greater than the preset threshold is judged as abnormal. The present invention reconstructs the time series dependency information, thereby improving the accuracy of anomaly detection of time series data.

[0184] above Figure 4 and Figure 5 The time series data anomaly detection device in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The time series data anomaly detection device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0185] Figure 6 6 is a schematic diagram of the structure of a time series data anomaly detection device provided by an embodiment of the present invention. The time series data anomaly detection device 600 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 610 (for example, one or more processors) and a memory 620, and one or more storage media 630 (for example, one or more mass storage devices) storing application programs 633 or data 632. Among them, the memory 620 and the storage medium 630 can be short-term storage or permanent storage. The program stored in the storage medium 630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the time series data anomaly detection device 600. Furthermore, the processor 610 may be configured to communicate with the storage medium 630 to execute a series of instruction operations in the storage medium 630 on the time series data anomaly detection device 600.

[0186] The time series data anomaly detection device 600 may also include one or more power supplies 640, one or more wired or wireless network interfaces 650, one or more input and output interfaces 660, and / or one or more operating systems 631, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. It will be appreciated by those skilled in the art that Figure 6 The structure of the time series data anomaly detection device shown does not constitute a limitation on the time series data anomaly detection device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0187] The present invention also provides a time series data anomaly detection device, which includes a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the time series data anomaly detection method in the above-mentioned embodiments.

[0188] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the time series data anomaly detection method.

[0189] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0190] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0191] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A time series data anomaly detection method, characterized in that: The time series data anomaly detection method comprises: Collect the time series data to be detected, and extract sub-time series data of fixed time length through a preset sliding time window; Calling a preset Gram angular field algorithm to perform 2D conversion on the sub-time series data to obtain a first time series angular field matrix; Inputting the first time series angle field matrix into a preset time series reconstruction model to reconstruct time series data to obtain a second time series angle field matrix; Calling a preset loss function, calculating loss values ​​of the first time series angular field matrix and the second time series angular field matrix, and determining whether the loss values ​​exceed a preset loss threshold; If yes, it is determined that the sub-time series data is abnormal; The time series reconstruction model includes an encoder and a decoder, wherein the encoder is composed of multiple layers of one-dimensional convolutional layers and pooling layers, and the decoder is composed of multiple layers of one-dimensional deconvolutional layers and convolutional layers. Before collecting the time series data to be detected, it also includes: Collecting time series data without abnormalities, and extracting sub-time series data without abnormalities of a fixed time length through the sliding time window; Calling a preset Gram angular field algorithm to perform 2D conversion on the abnormal sub-time series data to obtain a third time series angular field matrix; Inputting the third time series angle field matrix into the multi-layer one-dimensional convolutional layer for convolution operation to obtain a first feature matrix; Inputting the first feature matrix into the pooling layer for mean encoding to obtain a first encoding matrix; Inputting the first encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a first conversion matrix; Inputting the first conversion matrix into the convolutional layer for feature reconstruction to obtain a fourth time series angular field matrix; Calling a preset loss function to calculate loss values ​​of the third time series angular field matrix and the fourth time series angular field matrix; According to the loss value, calling a preset optimization algorithm to optimize parameters of the encoder and the decoder until the encoder and the decoder converge to obtain a time series reconstruction model; The step of calling a preset optimization algorithm to optimize parameters of the encoder and the decoder according to the loss value until the encoder and the decoder converge to obtain a timing reconstruction model includes: According to the loss value, calling a preset optimization algorithm to calculate the first-order moment estimate and the second-order moment estimate of the encoder and the decoder; The first-order moment estimate and the second-order moment estimate are corrected, and parameters are updated using the corrected first-order moment estimate and the second-order moment estimate until the encoder and the decoder converge to obtain a timing reconstruction model.

2. The time series data anomaly detection method according to claim 1, characterized in that: The collecting of the time series data to be detected and extracting sub-time series data of a fixed time length through the sliding time window includes: Collecting time series data to be detected, and adjusting the window length of the sliding time window; Through the adjusted sliding time window, time series acquisition values ​​of a fixed time length are acquired forward every preset fixed time to obtain sub-time series data of the time series data to be detected.

3. The time series data anomaly detection method according to claim 1, characterized in that: The calling of the preset Gram angular field algorithm to perform 2D conversion on the sub-time series data to obtain the first time series angular field matrix includes: Normalizing the time series values ​​in the sub-time series data to obtain normalized time series data; Performing polar coordinate conversion on the normalized time series data to obtain polar coordinate time series data; A plurality of time stamp corresponding values ​​in the polar coordinate time series data are intercepted, and a trigonometric function transformation is performed on each time stamp corresponding value to obtain a first time series angular field matrix.

4. The time series data anomaly detection method according to claim 1 or 3, characterized in that: The step of inputting the first time series angle field matrix into a preset time series reconstruction model to reconstruct the time series data to obtain the second time series angle field matrix comprises: Inputting the first time-series angular field matrix into the multi-layer one-dimensional convolutional layer for convolution operation to obtain a second feature matrix; Inputting the second feature matrix into the pooling layer for mean encoding to obtain a second encoding matrix; Inputting the second encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a second conversion matrix; The second conversion matrix is ​​input into the convolution layer for feature reconstruction to obtain a second time series angular field matrix.

5. The time series data anomaly detection method according to claim 4, characterized in that: The calling of the preset loss function to calculate the loss values ​​of the first time series angular field matrix and the second time series angular field matrix includes: Calculating matrix element errors at corresponding positions in the first timing angular field matrix and the second timing angular field matrix to obtain a plurality of matrix element error values; Call the preset loss function to calculate the sum of squares of the error values ​​of each matrix element; The average value of the sum of squares of the error values ​​of the matrix elements is calculated to obtain the loss values ​​of the first timing angular field matrix and the second timing angular field matrix.

6. A time series data anomaly detection device, characterized in that: The time series data anomaly detection device comprises: The acquisition module is used to acquire the time series data to be detected and extract sub-time series data of a fixed time length through a preset sliding time window; A 2D conversion module, used for calling a preset Gram angular field algorithm to perform a 2D conversion on the sub-time series data to obtain a first time series angular field matrix; A timing reconstruction module, used for inputting the first timing angular field matrix into a preset timing reconstruction model to reconstruct the timing data, so as to obtain a second timing angular field matrix; A judgment module, used to call a preset loss function, calculate the loss value of the first time series angle field matrix and the second time series angle field matrix, and judge whether the loss value exceeds a preset loss threshold; an output module, configured to determine that an abnormality exists in the sub-time series data if the loss value exceeds the loss threshold; The time series reconstruction model includes an encoder and a decoder, wherein the encoder is composed of multiple layers of one-dimensional convolutional layers and pooling layers, and the decoder is composed of multiple layers of one-dimensional deconvolutional layers and convolutional layers. The time series data anomaly detection device also includes: A sample processing module is used to collect time series data without abnormalities, and extract sub-time series data without abnormalities of a fixed time length through the sliding time window; call a preset Gram angular field algorithm to perform 2D conversion on the sub-time series data without abnormalities to obtain a third time series angular field matrix; A model training module is used to input the third time series angular field matrix into the multi-layer one-dimensional convolution layer for convolution operation to obtain a first feature matrix; input the first feature matrix into the pooling layer for mean encoding to obtain a first encoding matrix; input the first encoding matrix into the multi-layer one-dimensional deconvolution layer for feature conversion to obtain a first conversion matrix; input the first conversion matrix into the convolution layer for feature reconstruction to obtain a fourth time series angular field matrix; call a preset loss function to calculate the loss value of the third time series angular field matrix and the fourth time series angular field matrix; A model optimization module, used to call a preset optimization algorithm to optimize the parameters of the encoder and the decoder according to the loss value until the encoder and the decoder converge to obtain a time series reconstruction model; The model optimization module is specifically used for: According to the loss value, calling a preset optimization algorithm to calculate the first-order moment estimate and the second-order moment estimate of the encoder and the decoder; The first-order moment estimate and the second-order moment estimate are corrected, and parameters are updated using the corrected first-order moment estimate and the second-order moment estimate until the encoder and the decoder converge to obtain a timing reconstruction model.

7. The time series data anomaly detection device according to claim 6, characterized in that: The acquisition module is specifically used for: Collecting time series data to be detected, and adjusting the window length of the sliding time window; Through the adjusted sliding time window, time series acquisition values ​​of a fixed time length are acquired forward every preset fixed time to obtain sub-time series data of the time series data to be detected.

8. The time series data anomaly detection device according to claim 6, characterized in that: The 2D conversion module is specifically used for: Normalizing the time series values ​​in the sub-time series data to obtain normalized time series data; Performing polar coordinate conversion on the normalized time series data to obtain polar coordinate time series data; A plurality of time stamp corresponding values ​​in the polar coordinate time series data are intercepted, and a trigonometric function transformation is performed on each time stamp corresponding value to obtain a first time series angular field matrix.

9. A time series data anomaly detection device, characterized in that: The time series data anomaly detection device comprises: a memory and at least one processor, wherein the memory stores instructions; The at least one processor calls the instruction in the memory so that the time series data anomaly detection device executes the time series data anomaly detection method according to any one of claims 1 to 5.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by the processor, the time series data anomaly detection method according to any one of claims 1 to 5 is implemented.

Images