Time Series Decomposition

Abstract

A time series decomposition method and system are provided. Time series data including at least a periodic component is received, and a denoising filter can be applied to the time series data. In addition, a trend component and the periodic component are extracted from the time series data. A residual component can then be extracted from the time series data based on the trend component and the periodic component. An anomaly test can then be performed on the trend component or the residual component to determine whether an anomaly exists in the time series data.

Description

background

[0001] A time series is a series of data points indexed in chronological order. Examples of time series may include the number of users visiting a website each day, the closing value of a stock index each day, the number of vehicles passing a road each day, etc. These time series contain valuable and useful information for time series tasks such as anomaly detection, prediction, and classification. However, time series often exhibit complex patterns, for example, they may include components related to trends, seasonality (or periodicity), outliers, and noise. In order to improve and enhance the performance of subsequent time series tasks as described above, it is usually necessary to stably and accurately decompose the time series into various components (e.g., trend components, periodic components, noise components, etc.) before performing time series tasks (e.g., anomaly testing).

[0002] Various methods have been proposed to decompose time series, such as the standard STL (using a fitted periodic trend component). However, these methods are either computationally expensive or too inflexible to adapt to various situations of time series (such as long periods, high noise, outliers, trend changes, etc.). In addition, these time series decomposition methods may be based on models that are not applicable to real time series (e.g., Gaussian noise models). Summary of the invention

[0003] This summary introduces a simplified concept of a time series decomposition system, which will be further described in the detailed description below. This summary is not intended to identify the distinguishing technical features of the claimed claims, nor is it intended to be used to limit the scope of the claimed claims.

[0004] The present invention describes an implementation example of a time series decomposition system. In implementation, time series data including at least a periodic component with a known period length is received. In implementation, the time series data may further include a trend component that may be constant (e.g., without a trend), or may be a trend component that changes slowly or has a sudden change. A denoising filter may be applied to the time series data. Further, the trend component and the periodic component are extracted from the time series. Subsequently, a residual component may be extracted from the time series data based on the trend component and the periodic component. An anomaly test may then be performed on the trend component or the residual component to determine whether an anomaly exists in the time series data. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The detailed description is based on the accompanying drawings. In the drawings, the leftmost digit of a reference number indicates the drawing in which the reference number first appears. The use of the same reference number in different drawings indicates that the items are similar or identical.

[0006] Figure 1shows an example of an environment in which a time series decomposition system may be used.

[0007] Figure 2 An example time series decomposition system is shown in more detail.

[0008] Figure 3 An example of a method for time series decomposition is shown.

[0009] Figure 4 An example of a method for online anomaly testing is shown.

[0010] Figure 5 Experimental performance examples of the ADMM algorithm, the PDHG algorithm, and the proposed GADMM algorithm are shown. DETAILED DESCRIPTION

[0011] Overview

[0012] As mentioned above, existing time series decomposition methods are either computationally intensive or inflexible and cannot adapt to various conditions of time series (such as long time periods, high noise, outliers, trend changes, etc.).

[0013] The present invention discloses an exemplary time series decomposition system. The time series decomposition system can receive time series data and remove noise and outliers in the time series data. Then, the time series decomposition system can decompose the time series data into various components based on a specific decomposition method, such as a trend component, a periodic component, and a residual component. In implementation, the trend component can include a trend of change (slow or sudden), and the periodic component can include periodic changes or fluctuations.

[0014] After obtaining the various components, the time series decomposition system may perform an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data. Alternatively, the time series decomposition system may predict future data points of the time series data based on the trend component, the periodic component and the residual component. Since the time series decomposition system can effectively perform the above decomposition in real time, the time series decomposition system can perform the decomposition of the time series in an online mode, and is therefore also suitable for processing streaming time series data.

[0015] In implementation, the functions performed by the time series decomposition system described herein may be performed by multiple independent units or servers. For example, a receiving server may receive time series data, and a filtering server may remove outliers and noise from the time series data. The decomposition server decomposes the time series data into a trend component, a periodic component, and a residual component, and a test server may determine whether an anomaly exists in the time series data based on the trend component and / or the residual component. In implementation, a prediction server may predict future data points of the time series data based on the trend component, the periodic component, and the residual component.

[0016] Furthermore, although in the examples described herein the time series decomposition system may be implemented as a combination of software and hardware installed in a single device, in other examples the time series decomposition system may be implemented and distributed in multiple devices, or as a service provided by one or more computing devices in a network and / or cloud computing architecture.

[0017] This application describes various different embodiments and implementations. The next section describes an example framework suitable for practicing various implementations. Next, this application describes example systems, devices, and processes for implementing a time series decomposition system.

[0018] Example Environment

[0019] Figure 1 An exemplary environment 100 that can be used to implement a time series decomposition system is shown. The environment 100 may include a time series decomposition system 102. In this example, the time series decomposition system 102 is described as existing as a single entity or device. In some instances, the time series decomposition system 102 can be included in a computing device such as a client device 104. In other instances, the time series decomposition system 102 can be included in one or more servers, such as one or more servers 106 in the cloud. For example, some or all of the functionality of the time series decomposition system 102 may be included in or provided by a client device 104 and / or one or more servers 106 connected and communicating via a network 108.

[0020] In implementation, the client device 104 may be implemented as any of a variety of computing devices, including but not limited to a desktop computer, a notebook or portable computer, a handheld device, a netbook, an Internet appliance, a tablet or tablet computer, a mobile device (e.g., a mobile phone, a personal digital assistant, a smart phone, etc.), a server, etc., or a combination thereof.

[0021] The network 108 may be a wireless or wired network, or a combination thereof. The network 108 may be a collection of personal networks that are interconnected and operate as a single large network (e.g., the Internet or an intranet). Examples of such personal networks include, but are not limited to, telephone networks, wired networks, local area networks (LANs), wide area networks (WANs), and metropolitan area networks (MANs). In addition, each network may be a wireless or wired network, or a combination thereof. A wired network may include an electrical carrier connection (e.g., a communication cable, etc.) and / or an optical carrier or connection (e.g., a fiber optic connection, etc.). A wireless network may include, for example, a WiFi network, other radio frequency networks (e.g., Zigbee, etc.

[0022] In implementation, the time series decomposition system 102 may receive time series data and remove noise and outliers from the time series data. The time series decomposition system 102 may then decompose the time series data into various components, such as a trend component, a periodic component, and a residual component. After obtaining the various components, the time series decomposition system 102 may perform an anomaly test on the trend component or the residual component to determine whether an anomaly exists in the time series data. Additionally or alternatively, the time series decomposition system 102 may predict future data points for the time series data based on the trend component, the periodic component, and the residual component.

[0023] Time Series Decomposition System Example

[0024] Figure 2 The time series decomposition system 102 is shown in more detail. In implementation, the time series decomposition system 102 may include, but is not limited to, one or more processors 202, memory 204, and program data 206. In implementation, the time series decomposition system 102 may further include an input / output (I / O) interface 208 and / or a network interface 210. In implementation, some functions of the time series decomposition system 102 may be implemented using hardware, such as an ASIC (i.e., an application-specific integrated circuit), an FPGA (i.e., a field programmable gate array), and / or other hardware.

[0025] In implementation, the processor 202 may be configured to execute instructions stored in the memory 204, and / or instructions received from the input / output interface 208 and / or the network interface 210. In implementation, the processor 202 may be implemented as one or more hardware processors, such as a microprocessor, an instruction set processor for a specific application, a physical processing unit (PPU), a central processing unit (CPU), a graphics processing unit, a digital signal processor, a tensor processing unit, etc. In addition or alternatively, the functions described herein may be at least partially performed by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), etc.

[0026] The memory 204 may include a computer-readable storage medium in the form of a volatile memory, such as a random access memory (RAM) and / or a non-volatile memory, such as a read-only memory (ROM) or flash RAM. The memory 204 is an example of a computer-readable storage medium.

[0027] The computer-readable storage medium may include volatile or non-volatile types, removable or non-removable media, which may use any method or technology to implement the storage of information. The information may include computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electronically erasable programmable read-only memory (EEPROM), flash memory or other internal storage technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical disk storage, cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that a computing device can access. As defined herein, computer-readable media does not include any temporary media, such as modulated data signals and carrier waves.

[0028] Although in this example, only hardware components are described in the time series decomposition system 102, in other instances, the time series decomposition system 102 may also include other hardware components and / or other software components, such as a program unit for executing instructions for performing various operations stored in the memory 204. For example, the time series decomposition system 102 may further include a time series database 212 for storing time series data.

[0029] Method Example

[0030] Figure 3 A schematic diagram depicting an example of a method for time series decomposition is shown. Figure 4 A schematic diagram describing an example of a method for online anomaly testing is shown. Figure 3 and Figure 4 The method can but does not have to be Figure 1 Use in an environment Figure 2 For ease of explanation, refer to Figure 1 and Figure 2 Methods 300 and 400 are described. However, methods 300 and 400 may alternatively be implemented in other environments and / or using other systems.

[0031] The method 300 and method 400 are described in the general case of computer executable instructions. Generally, computer executable instructions may include routines, programs, objects, components, data structures, procedures, modules, functions, and classes that perform specific functions or implement specific abstract data types. In addition, each method example is represented as a collection of boxes representing a sequence of operations in a logical flow chart, and the logical flow chart represents a sequence of operations that can be implemented in hardware, software, firmware, or a combination thereof. The order of the described methods is not intended to be interpreted as a limitation, and any number of boxes of the methods can be combined in any order to implement the method or replace the method. In addition, without departing from the spirit and scope of the subject matter described herein, each box can be omitted from the method. In the case of software, the box represents a computer instruction, and when executed by one or more processors, the listed operations are performed. In the case of hardware, some or all of the boxes may represent a dedicated integrated circuit chip (ASICs) or other physical components that perform the listed operations.

[0032] Back to Figure 3 In block 302 , the time series decomposition system 102 may receive time series data (ie, data or data points associated with a time series), the time series data including at least one periodic component.

[0033] In implementation, the time series decomposition system 102 may receive the time series data (i.e., data or data points associated with a time series) from a client device 104 or one of the one or more servers 106. The time series data may include a series of data points arranged in chronological order. In implementation, the time series data may correspond to a practical application, such as the number of users visiting a website daily or hourly, the closing value of a stock index daily or hourly, the number of vehicles passing a road daily or hourly, etc. In implementation, the time series data may include at least a periodic component with a periodic length that may be known or unknown, such as a periodic length of each day or week. In implementation, the time series data may further include a trend component that may be a constant (i.e., without a trend), or the trend component may be slowly changing or abrupt.

[0034] In block 304 , the time series decomposition system 102 may apply a denoising filter to the time series data.

[0035] In implementation, the time series data may include multiple different components, such as trend components, periodic components, residual components, outlier components, and noise components. As an example and not limitation, the time series data (y1, ..., yN) may be decomposed or expressed in the following form:

[0036] y t =s t +τ t +r t t=1,2,…,N (1)

[0037] where y t represents the observed value at time t, s t represents the periodic component with period length (periodic length) T, τ t represents the trend component, and r t represents the residual component.

[0038] In implementation, the trend component may include a slowly increasing or decreasing trend component, or a trend component having a sudden change in trend, such as a sudden change in level in the trend.

[0039] In implementations, the periodic component may include a periodic pattern that fluctuates about a baseline. Additionally or alternatively, the periodic component may include a repeating pattern that changes slowly or remains constant over time. Additionally or alternatively, the periodic component may include a pattern that repeats regularly over a particular time period, or a pattern that switches from one time period to another.

[0040] In an implementation, the residual component may include signals other than the signals associated with the trend component and the periodic component in the time series data. In an implementation, the residual component may be further decomposed into two components, namely, a component associated with an outlier (e.g., an increase or decrease) and a component associated with noise (e.g., Gaussian noise). As an example and not limitation, the residual component may be expressed as:

[0041] r t =a t +n t (2)

[0042] Among them, a t indicates an outlier (e.g., an increase or decrease), and n t Represents noise, such as white noise.

[0043] In implementation, the time series decomposition system 102 may apply a denoising filter to the time series data to remove noise contained in the time series data to obtain filtered time series data, such as At the same time, the trend component τ is saved t Any change or fluctuation in the trend (such as a sudden change in trend) and a t Examples of the denoising filter may include, but are not limited to, a bilateral filter.

[0044] By way of example and not limitation, after applying a denoising filter such as a bilateral filter, the filtered time series data is obtained, i.e. And expressed as:

[0045]

[0046] Where J represents a filter window of length 2H+1, and the filter weights are given by two Gaussian functions:

[0047]

[0048] in is the normalization factor, and are two parameters that control the degree of smoothing of the filtered time series.

[0049] After applying the denoising filter, y′ t =s t +τ t +r′ t ,in in Represents the noise after filtering.

[0050] In block 306 , the time series decomposition system 102 may extract the trend component from the time series data.

[0051] In implementation, the time series decomposition system 102 may use (but is not limited to) robust least absolute deviation (LAD) regression with sparse regularization to extract the trend component. t represents a periodic differential signal, that is, in, is a first-order difference operation, and the difference variables after two periods can be assumed to be close to zero. In this case, extracting the trend component can be expressed as minimizing the following weighted sum objective function:

[0052]

[0053] in, Represents a second-order difference operation.

[0054] Since LAD is robust to outliers, the first term in equation (5) corresponds to the empirical error using the LAD. The second and third terms in equation (5) are the trend component τ t In practice, the second term in equation (5) can be assumed to be a trend difference The third term in equation (5) assumes that the trend in the trend component is smooth and piecewise linear, so is sparse. By designing this implementation, the trend component τ t Can capture sudden level changes and gentle trend changes.

[0055] In an embodiment, the objective function I equation (5) can be rewritten in an equivalent matrix form as shown below:

[0056]

[0057] Among them, ‖x‖1=∑ i |x i | represents the l1 norm of vector x, g and The corresponding vector form is as follows:

[0058] g=[g T+1 ,g T+2 ,…,g N ] T (7)

[0059]

[0060] Where M and D are (NT)×(N-1) and (N-2)×(N-1) Toeplitz matrices, respectively, and have the following form:

[0061]

[0062] In implementation, in order to facilitate the process of extracting the trend component, the three l1 norms in equation (6) can be expressed as a single l1 norm, namely:

[0063] f(x): =‖Ax-b‖1 (10)

[0064] Where x represents And the matrix A and vector b are represented as:

[0065]

[0066] In implementation, linear programming (LP) can be used to solve the minimized l1 loss in equation (10). Alternatively, for large-scale l1 loss minimization, the ADMM algorithm can be used. In implementation, equation (10) can be rewritten as follows:

[0067]

[0068] The following augmented Lagrangian can be obtained:

[0069]

[0070] Where u is the dual variable and ρ is the penalty parameter. Using the ADMM procedure, the following update steps can be obtained:

[0071]

[0072]

[0073] u t+1 = arg min u L ρ (x,y,u)=u t +ρ(Ax t+1 -y t+1 -b) (15)

[0074] Where S k (x) is a soft threshold operator, which is defined as:

[0075] S κ (x)=(1-κ / |x| + x.

[0076] In practice, due to the special matrix structure shown in equation (9), based on the cumulative sum and displacement difference of the corresponding vectors, y can be obtained by equivalently implementing matrix-vector multiplications respectively. t+1 and u t+1 The update step Complexity. In addition, (A T A) -1 A T It can be calculated once and then the update step is stored to save complexity. The above ADMM algorithm can bring faster operation speed than the LP algorithm, and because x t+1 The matrix multiplication in the update step Operation, each iteration of the ADMM algorithm is

[0077] In implementation, the time series decomposition system 102 can design and use the proposed GADMM algorithm to extract the trend component. In implementation, the proposed GADMM algorithm can take advantage of the special structure in the matrices M and D, and can further reduce the complexity of each iteration from Reduce to At the same time, the convergence of the number of iterations is roughly the same as that of the ADMM algorithm.

[0078] In practice, since the matrices M and D are very similar to circulant matrices, and circulant matrices have good properties for linear systems, we can write and Add them together to get the corresponding circulant matrix and As shown below:

[0079]

[0080]

[0081] In implementation, in Similar to A in equation (10), its structure is as follows:

[0082]

[0083] In practice, H and A T The difference between A can be expressed as It can be achieved through Calculate. In equation (13), x t+1 The update step can be achieved by adding an additional proximal term Make an estimate to reduce its complexity, namely:

[0084]

[0085] Where v is represented by:

[0086]

[0087] In implementation, due to the special matrix structure in matrix-vector multiplication, we can obtain The complexity is similar to that in equations (14) and (15) for y t+1 and u t+1 In addition, due to and is a circulant matrix, so is also a circulant matrix. Therefore, discrete Fourier transform (DFT) and inverse Fourier transform (IDFT) can be used to speed up the matrix operation H in equation (17). -1 v. By way of example and not limitation, if F is a (N-1)×(N-1) DFT transform matrix, and h is the first column of H, then the following relationship can be obtained:

[0088] H=F -1 diag(Fh)F

[0089] Therefore, in equation (17) for x t+1 The update steps can be simplified to:

[0090] x t+1 ≈H -1 v=F -1 diag -1 (Fh)Fv

[0091] =IDFT(DFT(v). / DFT(h)) (19)

[0092] Among them, . / represents dot division.

[0093] Since DFT / IDFT can be performed by fast Fourier transform (FFT) algorithm and The operation is effectively calculated, so in equation (19) t+1 The complexity of the update step is also Therefore, based on the above analysis, the proposed GADMM algorithm (based on, for example, equations (14), (15) and (19)) can achieve an overall Complexity. In implementation, the convergence of the optimality gap of the proposed GADMM algorithm is theoretically supported by the following theorem:

[0094] Theorem 1: Let z denote the concatenated vector of variables (x, y, u), and let x * and *is the optimal solution of equation (12). is a set of solutions generated by the proposed GADMM algorithm, where u0=0, and some given x0 and y0. is the corresponding ergodic mean. If but

[0095]

[0096] where M is the number of rows in the matrix A. In particular, if

[0097]

[0098] because is semi-positive definite, the convergence of the proposed GADMM is known from Theorem 1. In addition, Theorem 1 summarizes the convergence results of the ADMM algorithm when applied to equation (12). The ADMM algorithm is the proposed GADMM algorithm in In this case, it means that equation (20) for the ADMM algorithm is

[0099] Table 1 below shows the comparison results of the complexity and convergence of the proposed GADMM algorithm, the ADMM algorithm and the PDHG algorithm.

[0100]

[0101] Table 1

[0102] It can be seen from the table that if This leads to Usually than Therefore, the actual number of iterations required for the proposed GADMM is usually Therefore, in terms of total computational cost, the proposed GADMM is usually times better than ADMM and times better than PDHG.

[0103] Using the proposed GADMM, the solution of equation (12) can be obtained and expressed as if (subsequent estimation), the corresponding trend output based on τ1 can be:

[0104]

[0105] In block 308 , the time series decomposition system 102 may extract the periodic component from the time series.

[0106] In implementation, after extracting and estimating the trend component from the time series data, the time series decomposition system 102 may apply non-local periodic filtering to the time series data. represents the time series data after the trend component is extracted or deleted. In this case, the non-local periodic filtering can consider a predetermined number of y″ t-kT ,…,y″ t-T Instead of considering a predetermined number (e.g., K) of data points (i.e., y″ t-kT ,…,y″ t-T ), K and H are positive integers greater than or equal to 1. For example, a particular data point y″ t-kT The neighborhood of y can include 2H+1 neighbors, i.e., y″ t-kT-H ,y″ t-kT-H+1 ,…,y″ t-kT ,y″ t-kT+1 ,…,y″ t-kT+H ..

[0107] In implementation, the periodic component can be further modeled as y″ j A weighted linear combination of j is located in the neighborhood determined above. In implementation, y″ t and y″ j The weight between y″ may depend not only on the separation distance of the two data points in the time dimension (e.g., the difference between their respective indices t and j), but also on y″ t and y″ j How close is it. Intuitively, a neighborhood with similar periodicity carries y″ t The data points with similar periodicity can be given greater weights. In this way, points with similar periodicity can be found, thereby solving the problem of periodic changes. In implementation, outliers can be given smaller weights, so that the non-local periodic filtering can be robust or tolerant to outliers.

[0108] In implementation, extracting the periodic component by the non-local periodic filtering can be expressed as follows:

[0109]

[0110] in, and Ω are determined as:

[0111]

[0112]

[0113] Consider the first K periodic neighborhoods, each containing 2H+1 data points.

[0114] In block 310 , the time series decomposition system 102 may obtain a residual component.

[0115] In implementation, the time series decomposition system 102 may obtain the residual component by subtracting the noise component, the trend component, and the periodic component from the time series data. For example, after removing the noise component, the trend component, and the periodic component from the time series data, the residual component may be expressed as:

[0116]

[0117] In implementation, the time series decomposition system 102 may further adjust the periodic component using the constraint that the sum of all periodic elements within a single period is zero, ie In implementation, the time series decomposition system 102 may remove the average value of the periodic component obtained above, which also corresponds to the estimation of the trend point τ1 in equation (22). Specifically, the estimated trend point may be expressed as follows:

[0118]

[0119] In implementation, the respective estimates of the periodic component, the trend component and the residual component may be updated as follows:

[0120]

[0121]

[0122]

[0123] In implementation, the estimated residual component can be further derived The elements of

[0124]

[0125] The above equation shows that the residual component Residual periodic components can be included and the residual trend component In addition, when estimating the trend component, g t To estimate In implementation, the time series decomposition system 102 may use an alternating algorithm to obtain more accurate estimates of the trend component, the periodic component, and the residual component. As an example and not a limitation, after obtaining the estimated values ​​of the trend component, the periodic component, and the residual component as described in blocks 304-310, the time series decomposition system 102 may repeatedly or iteratively perform operations on the residual component to further extract the trend component, the periodic component, and the residual component as described in the above blocks 304-310 until the residual component converges or the change or difference between consecutive estimates of the residual component is less than a predetermined threshold or percentage.

[0126] In block 312 , the time series decomposition system 102 may perform an anomaly test on the trend component or the residual component to determine whether an anomaly exists in the time series data.

[0127] In implementation, after obtaining respective estimates of the trend component, the periodic component, and the residual component, the time series decomposition system 102 may apply one or more statistical tests to different components of the time series data to test corresponding anomaly types. For example, the time series decomposition system 102 may apply one or more statistical tests to the trend component to determine whether an anomaly type exists in the trend component of the time series data. In implementation, the anomaly type may include, but is not limited to, a long-term monotonic trend or a change in mean value. Accordingly, the one or more statistical tests may include, but are not limited to, a t-test for a change in mean value or an MK test for a trend that does not change over a long period of time.

[0128] In implementation, the time series decomposition system 102 may apply one or more statistical tests to the residual components to determine whether there are abnormal types in the residual components of the time series data. In implementation, the abnormal types may include, but are not limited to, changes in variance or sudden rise and fall types. Accordingly, the one or more statistical tests may include, but are not limited to, an F test for the variance homogeneity test for the variance changes, or an extreme studentized deviation (ESD) test for the sudden rise and fall types.

[0129] In block 314 , the time series decomposition system 102 may predict a data point of the time series at a future time point based at least in part on the trend component, the periodic component, and the residual component obtained from the decomposition.

[0130] In implementation, after estimating the trend component, the periodic component, and the residual component, the time series decomposition system 102 may use a prediction method to predict the data points of the time series at a certain point in the future based on the trend component, the periodic component, and the residual component. Examples of the prediction method may include, but are not limited to, extrapolation, regression, etc. The time series decomposition system 102 may send the estimated data points to the sender of the time series data (e.g., the client device 104 or one of the one or more servers 106) for making decisions based on the predicted data points, such as allocating resources at the certain point in the future.

[0131] Back to Figure 4 In block 402 , the time series decomposition system 102 may receive a data stream, the data stream comprising a plurality of data points.

[0132] In implementation, the time series decomposition system 102 may receive a data stream associated with a time series continuously or within a certain period of time. In implementation, the data stream may include a plurality of data points within a certain period of time.

[0133] In block 404 , the time series decomposition system 102 may apply a denoising filter to a subset of the plurality of data points of the data stream in an online mode by sliding or moving a time window.

[0134] In implementation, in an online node or in real time, the time series decomposition system 102 may consider a width of A subset of multiple data points within a sliding window, for example, and applying a denoising filter (e.g., the bilateral filter described in the previous description, or any other suitable denoising filter) to generate a denoised signal Where w is the total number of data points in the time series. Then, the time series decomposition system 102 can and Y′ obtained from time t-1 t-1 The remaining points Combined with coarse filtering to estimate the complete denoised signal Y′ at time t t .

[0135] In block 406 , the time series decomposition system 102 may extract or estimate a trend component from the time series at fixed time intervals.

[0136] In implementation, the time series decomposition system 102 may use the proposed GADMM algorithm to perform trend extraction operations at fixed time intervals (e.g., after receiving a predetermined number of new data points such as 5, 10, etc. for the time series) instead of continuously, thereby saving the computational cost of solving the optimization problem using the proposed GADMM algorithm. In addition, the time series decomposition system 102 may consider performing trend extraction operations in a sliding window (e.g., ), rather than considering the entire time series (e.g., w) to estimate the trend difference (e.g., ), and use the trend component that has been estimated at time t–1 as the initial solution when solving the optimization problem using the proposed GADMM algorithm at time t, resulting in a faster convergence speed.

[0137] In block 408 , the time series decomposition system 102 may extract or estimate periodic components and residual components from the streaming time series at fixed time intervals.

[0138] In implementation, similar to the trend extraction, the time series decomposition system 102 may extract or estimate the periodic component and the residual component from the streaming time series at fixed time intervals.

[0139] In block 410 , the time series decomposition system 102 may perform an anomaly test on the streaming time series based on one or more corresponding statistical tests to test whether there are any anomalies in the time series.

[0140] In implementation, the time series decomposition system 102 may test whether one or more types of anomalies exist in the time series. Examples of the anomaly types may include, but are not limited to, sudden rises and falls (SD), mean changes (COM), and variance changes (COV). In implementation, the sudden rise and fall (SD) refers to a sudden increase or decrease in the observed value within a predetermined time period (e.g., a very short time period relative to the total time period of the time series), which may depend on the sampling rate of the time series and the data type of the time series. For example, if the time series corresponds to the number of users visiting a website per minute over a period of time, the predetermined time period may be 1 or 2 minutes. Alternatively, if the time series corresponds to the stock value of a stock, the predetermined time period may be 1-10 seconds.

[0141] In implementation, the change in mean (COM) refers to the change in average level over a predetermined time period (e.g., a relatively long time period relative to the total time period of the time series), which may also depend on the sampling rate of the time series and the data type of the time series. In implementation, the change in variance (COV) refers to a sudden change in the fluctuation pattern, which can be measured by the variance.

[0142] In implementation, the one or more corresponding statistical tests may include, but are not limited to, performing an ESD test on the residual component of the time series for abnormal types of sudden rise and fall, performing an F test on the residual component of the time series for abnormal types of variance change, and performing a t test on the trend component of the time series for mean change.

[0143] Although the blocks of the above methods are described as being performed in a particular order, in some implementations, some or all of the blocks of the described methods may be performed in other orders, or in parallel.

[0144] Comparison between different trend extraction algorithms

[0145] Since the most time-consuming and expensive operations in the time series decomposition are those associated with the trend extraction, in order to further illustrate the improvement of the trend extraction method proposed in the present invention over the prior art, this paper provides a comparison of the proposed GADMM algorithm with other trend extraction algorithms. By way of example and not limitation, the performance of the proposed GADMM algorithm is compared with the PDHG algorithm (primal-dual hybrid gradient algorithm) and the ADMM algorithm (alternating direction multiplier method). In this example, numerical experiments written in Python 3.7 on an Apple notebook with a 2.3GHZ Intel i5CP and 8GB RAM were used. The average processing time and average number of iterations required to achieve a 1% optimality gap were recorded for comparison.

[0146] Figure 5 The experimental performance of the ADMM algorithm, the PDHG algorithm and the proposed GADMM algorithm on a representative signal (N = 2160 and T = 576, where N is the number of data points in the time series and T is the time period of the periodic component in the time series) is shown. All algorithms are run at the same rate However, the time required for each iteration in the proposed GADMM algorithm is shorter than that in the ADMM algorithm, and the number of iterations of the proposed GADMM algorithm is less than that of the PDHG algorithm, so the proposed GADMM algorithm has a faster speed.

[0147] Furthermore, to illustrate the O(N / logN) improvement of the proposed GADMM algorithm over the ADMM algorithm, N (i.e., the number of data points in the time series) is varied while keeping the ratio of N / T fixed at 16. For example, Table 2 below shows that the proposed GADMM algorithm is 10-144 times faster than the ADMM algorithm at different N, and the number of iterations required by the proposed GADMM algorithm is almost the same, while the number of iterations required by the PDHG algorithm is linearly related to N.

[0148] Table 2: Comparison results of ADMM, PDHG and the proposed GADMM at different values ​​of N.

[0149]

[0150] In addition, to illustrate the O(N / logN) improvement of the proposed GADMM algorithm over the PDHG, T (the time period of the periodic component in the time series) is varied while keeping N constant. As shown in Table 3, the number of iterations of the PDHG algorithm is linearly related to T, while the proposed GADMM algorithm is insensitive to T. When the T value is large, the advantage of the proposed GADMM algorithm over the ADMM algorithm is more obvious.

[0151] Table 3: Comparison results of ADMM, PDHG and the proposed GADMM at different T values.

[0152]

[0153] From the above, it can be seen that the proposed GADMM algorithm for trend extraction provides substantial improvements compared to the prior art such as the ADMM algorithm and the PDHG algorithm.

[0154] in conclusion

[0155] Although implementations have been described using language directed to structural features and / or methodological acts, it should be understood that the claims are not necessarily limited to the specific features or acts described. Instead, the specific features and acts are disclosed as exemplary forms of implementing the claimed claims. Additionally or alternatively, some or all of the operations may be implemented by one or more ASICS, FPGAs, or other hardware.

[0156] The present invention may be further understood using the following terms.

[0157] Article 1: A method implemented by one or more computing devices, the method comprising: receiving time series data containing at least one periodic component; applying a denoising filter to the time series data; extracting a trend component from the time series data; extracting the periodic component from the time series data; obtaining a residual component from the time series data based on the trend component and the periodic component, and performing an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data.

[0158] Clause 2: The method of clause 1, wherein the denoising filter comprises a bilateral filter.

[0159] Article 3: A method as described in Article 1, wherein extracting the periodic component from the time series data comprises: extracting the periodic component from the time series data by non-local periodic filtering.

[0160] Clause 4: A method as described in Clause 3, wherein the non-local periodic filtering includes considering a predetermined number of prior periodic neighborhoods, each neighborhood containing a predetermined number of data points.

[0161] Article 5: A method as described in Article 1, wherein extracting the trend component from the time series data includes: modeling the trend component according to at least one circulant matrix; and calculating the modeled trend component using a GADMM algorithm of fast Fourier transform.

[0162] Article 6: A method as described in Article 1, wherein performing an anomaly test on the trend component includes: applying one or more statistical tests to the trend component to determine whether there is an anomaly type in the trend component of the time series data, the anomaly type including a monotonic trend or a mean change, and the one or more statistical tests at least include a t test or an MK test.

[0163] Article 7: A method as described in Article 1, wherein the residual component is subjected to anomaly testing, comprising: applying one or more statistical tests to the residual component to determine whether there is an abnormal type in the residual component of the time series data, the abnormal type including at least one type of variance change or sudden rise and fall, and the one or more statistical tests including at least an F test or an extreme studentized deviation (ESD) test.

[0164] Clause 8: The method of clause 1, wherein the periodic component comprises a periodic component having a pattern that repeats regularly within a particular time period, or a periodic component having a pattern that switches from one time period to another.

[0165] Article 9: One or more computer-readable storage media storing executable instructions, which, when executed by one or more processors, cause the one or more processors to perform actions, including: receiving time series data containing at least one periodic component; applying a denoising filter to the time series data; extracting a trend component from the time series data; extracting the periodic component from the time series data; obtaining a residual component from the time series data based on the trend component and the periodic component, and performing an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data.

[0166] Clause 10: One or more computer-readable storage media as described in Clause 9, wherein the denoising filter comprises a bilateral filter.

[0167] Article 11: One or more computer-readable storage media as described in Article 9, wherein extracting the periodic component from the time series data includes: extracting the periodic component from the time series data through non-local periodic filtering.

[0168] Clause 12: One or more computer-readable storage media as described in Clause 11, wherein the non-local periodic filtering includes considering a predetermined number of prior periodic neighborhoods, each neighborhood containing a predetermined number of data points.

[0169] Article 13: One or more computer-readable storage media as described in Article 9, wherein extracting the trend component from the time series data includes modeling the trend component according to at least one circulant matrix; and calculating the modeled trend component using a GADMM algorithm with fast Fourier transform.

[0170] Article 14: One or more computer-readable storage media as described in Article 9, wherein performing an anomaly test on the trend component includes: applying one or more statistical tests to the trend component to determine whether an anomaly type exists in the trend component of the time series data, the anomaly type including a monotonic trend or a mean change, and the one or more statistical tests at least include a t test or an MK test.

[0171] Article 15: One or more computer-readable storage media as described in Article 9, wherein the abnormality test for the residual component includes: applying one or more statistical tests to the residual component to determine whether there is an abnormal type in the residual component of the time series data, the abnormal type includes at least one type of variance change or sudden rise and fall, and the one or more statistical tests include at least an F test or an extreme studentized deviation (ESD) test.

[0172] Clause 16: One or more computer-readable storage media as described in Clause 9, wherein the periodic component includes a periodic component having a pattern that repeats regularly within a particular time period, or a periodic component having a pattern that switches from one time period to another time period.

[0173] Article 17: A system comprising one or more processors and a memory storing executable instructions, wherein when the executable instructions are executed by the one or more processors, the one or more processors perform actions, including: receiving time series data containing at least one periodic component; applying a denoising filter to the time series data; extracting a trend component from the time series data; extracting the periodic component from the time series data; obtaining a residual component from the time series data based on the trend component and the periodic component, and performing an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data.

[0174] Article 18: A system as described in Article 17, wherein extracting the periodic component from the time series data includes extracting the periodic component from the time series data by non-local periodic filtering, and the non-local periodic filtering includes considering a predetermined number of prior periodic neighbors, each neighborhood containing a predetermined number of data points.

[0175] Article 19: A system as described in Article 17, wherein extracting the trend component from the time series data includes modeling the trend component according to at least one circulant matrix; and calculating the modeled trend component using a GADMM algorithm with fast Fourier transform.

[0176] Article 20: A system as described in Article 17, wherein performing an anomaly test on the trend component includes applying one or more statistical tests to the trend component to determine whether an anomaly type exists in the trend component of the time series data, the anomaly type includes a monotonic trend or a mean change, and the one or more statistical tests include at least a t test or an MK test; and performing an anomaly test on the residual component includes applying one or more statistical tests to the residual component to determine whether an anomaly type exists in the residual component of the time series data, the anomaly type includes at least one type of variance change or a sudden rise and fall, and the one or more statistical tests include at least an F test or an extreme studentized deviation (ESD) test.

Claims

1. A method implemented by one or more computing devices, the method comprising: receiving time series data containing at least one periodic component; The time series data corresponds to at least one of the following time series data in practical applications: the number of users accessing a website daily or hourly, or the number of vehicles passing a road daily or hourly; applying a denoising filter to the time series data; Extracting a trend component from the time series data includes: modeling the trend component according to at least one circulant matrix; and calculating the modeled trend component using a preset algorithm, wherein the preset algorithm includes at least one of an ADMM algorithm and a GADMM algorithm of a fast Fourier transform; extracting the periodic component from the time series data; Obtaining a residual component from the time series data based on the trend component and the periodic component; as well as, Performing an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data; Based on the trend component, the periodic component and the residual component, predicting a data point of the time series data at a certain time point in the future; sending the estimated data points to a sender of the time series data for making a decision based on the predicted data points; Wherein, the time series data contains valuable and useful information for time series tasks of anomaly detection, prediction and classification.

2. The method of claim 1, wherein: The denoising filter comprises a bilateral filter.

3. The method of claim 1, wherein: Extracting the periodic component from the time series data includes: extracting the periodic component from the time series data by non-local periodic filtering.

4. The method of claim 3, wherein: The non-local periodic filtering includes considering a predetermined number of prior periodic neighborhoods, each neighborhood containing a predetermined number of data points.

5. The method of claim 1, wherein: Performing an anomaly test on the trend component includes: applying one or more statistical tests to the trend component to determine whether there is an anomaly type in the trend component of the time series data, the anomaly type including a monotonic trend or a mean change, and the one or more statistical tests at least include a t test or an MK test.

6. The method of claim 1, wherein: The residual component is subjected to an abnormality test, comprising: applying one or more statistical tests to the residual component to determine whether there is an abnormal type in the residual component of the time series data, the abnormal type at least including one of variance change or sudden rise and fall, and the one or more statistical tests at least including an F test or an extreme studentized deviation (ESD) test.

7. The method of claim 1, wherein: The periodic component includes a periodic component having a pattern that is regularly repeated within a certain time period, or a periodic component having a pattern that switches from one time period to another.

8. One or more computer-readable storage media storing executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising: receiving time series data containing at least one periodic component; The time series data corresponds to at least one of the following time series data in practical applications: the number of users accessing a website daily or hourly, or the number of vehicles passing a road daily or hourly; applying a denoising filter to the time series data; Extracting a trend component from the time series data includes: modeling the trend component according to at least one circulant matrix; and calculating the modeled trend component using a preset algorithm, wherein the preset algorithm includes at least one of an ADMM algorithm and a GADMM algorithm of a fast Fourier transform; extracting the periodic component from the time series data; obtaining a residual component from the time series data based on the trend component and the periodic component; and Performing an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data; Based on the trend component, the periodic component and the residual component, predicting a data point of the time series data at a certain time point in the future; sending the estimated data points to a sender of the time series data for making a decision based on the predicted data points; Wherein, the time series data contains valuable and useful information for time series tasks of anomaly detection, prediction and classification.

9. A system comprising: one or more processors; as well as, A memory storing executable instructions, wherein when the executable instructions are executed by the one or more processors, the one or more processors perform the following actions, including: Receiving time series data including at least one periodic component; the time series data corresponds to at least one of the following time series data in practical applications: the number of users visiting a website daily or hourly, or the number of vehicles passing a road daily or hourly; applying a denoising filter to the time series data; Extracting a trend component from the time series data includes: modeling the trend component according to at least one circulant matrix; and calculating the modeled trend component using a preset algorithm, wherein the preset algorithm includes at least one of an ADMM algorithm and a GADMM algorithm of a fast Fourier transform; extracting the periodic component from the time series data; obtaining a residual component from the time series data based on the trend component and the periodic component; and, Performing an anomaly test on the trend component or the residual component to determine whether there is an anomaly in the time series data; Based on the trend component, the periodic component and the residual component, predicting a data point of the time series data at a certain time point in the future; sending the estimated data points to a sender of the time series data for making a decision based on the predicted data points; Wherein, the time series data contains valuable and useful information for time series tasks of anomaly detection, prediction and classification.

10. The system of claim 9, wherein: Extracting the periodic component from the time series data includes extracting the periodic component from the time series data by non-local periodic filtering, the non-local periodic filtering including considering a predetermined number of prior periodic neighborhoods, each neighborhood containing a predetermined number of data points.

Images