A method, device and equipment for detecting abnormal time series jumps

Abstract

The present invention provides a method, device and equipment for detecting abnormality of time series jump, and the method comprises: obtaining original time series data, and preprocessing the original time series data to generate a first image in a preset format; dividing the first image according to the data shape in the first image, and marking the part with jump; moving the jump part to the middle position of the first image, and processing the jump part into a left jump to generate jump data; and marking the new time series data according to the jump data to complete abnormality detection. The problem of long model training time and inability to efficiently identify various time series in the prior art is improved.

Description

Technical Field

[0001] The present invention relates to the field of monitoring, and in particular to a method, a device and equipment for detecting abnormal time series jumps. Background Art

[0002] Time series refers to a series of statistics or observations of an indicator over time. Time series can be seen everywhere in our lives, and they are formed all the time in various fields such as finance, industry, and computers. Anomaly detection refers to the identification of abnormal behaviors that are different from history. For example, the patient's heart rate information, the system's request period, etc. all require anomaly detection technology to monitor.

[0003] Since time series have low visualization cost and obvious rules, they are often used in various fields. However, as the system becomes increasingly large, time series monitoring by manpower can no longer meet the growing demand, so people begin to use some anomaly detection algorithms to assist decision making. Jump anomalies are the most common type of time series anomalies, and this anomaly plays a very important role in judging the state change of time series.

[0004] For existing anomaly detection technologies based on model training, the model training process often relies on a large number of model hyperparameters. With different settings of the model hyperparameters, the recognition effect of the model is also uneven. In addition, a large amount of data is required for model training, which not only consumes a lot of time, but also cannot guarantee efficient recognition of various time series.

[0005] In view of this, this application is filed. Summary of the invention

[0006] The present invention discloses a method, a device and an equipment for detecting time series jump anomaly, aiming to improve the problem in the prior art that the model training time is long and various time series cannot be efficiently identified.

[0007] A first embodiment of the present invention provides a method for detecting time series jump anomalies, comprising:

[0008] Acquiring original time series data, and preprocessing the original time series data to generate a first image in a preset format;

[0009] Dividing the first image according to the data shape in the first image, and marking the part with jump;

[0010] Moving the transition part to the middle position of the first image, and processing the transition part into a left transition to generate transition data;

[0011] According to the jump data, the new time series data is labeled to complete anomaly detection.

[0012] Preferably, the original time series data is acquired, and the original time series data is preprocessed to generate a first image in a preset format;

[0013] Get the original time series data;

[0014] The original time series data is locally normalized to obtain the data at each time point, so as to generate a first image in a preset format.

[0015] Preferably, the data shape in the first image includes a normal part, a jump part, an abnormal part and a large noise part.

[0016] Preferably, the step of moving the transition portion to the middle position of the first image and processing the transition portion into a left transition to generate the transition data is specifically as follows:

[0017] Obtaining the horizontal coordinate of the center point of the jump part;

[0018] Moving the jump portion until the horizontal coordinate of the center point is the middle position of the first image, thereby generating a second image;

[0019] Filling the blank part in the second image with the numerical ordinate of the first point in the first image;

[0020] The data in the second image is processed as left transition to generate transition data.

[0021] Preferably, the step of labeling the new time series data according to the jump data to complete the anomaly detection is as follows:

[0022] Call the learning model;

[0023] Training the learning model using the jump data;

[0024] The new time series data is input into the trained learning model, wherein the trained learning model labels the new time series data to complete anomaly detection.

[0025] A second embodiment of the present invention provides a device for detecting time series jump anomalies, comprising:

[0026] A first image generating unit, used for acquiring original time series data and preprocessing the original time series data to generate a first image in a preset format;

[0027] a marking unit, configured to divide the first image according to the data shape in the first image, and mark the part with jump;

[0028] A transition data generating unit, used for moving the transition part to the middle position of the first image, and processing the transition part into a left transition, so as to generate transition data;

[0029] The anomaly detection unit is used to mark the new time series data according to the jump data to complete anomaly detection.

[0030] Preferably, the first image generating unit is specifically used for:

[0031] Get the original time series data;

[0032] The original time series data is locally normalized to obtain the data at each time point, so as to generate a first image in a preset format.

[0033] Preferably, the transition data generating unit is specifically used for:

[0034] Obtaining the horizontal coordinate of the center point of the jump part;

[0035] Moving the jump portion until the horizontal coordinate of the center point is the middle position of the first image, thereby generating a second image;

[0036] Filling the blank part in the second image with the numerical ordinate of the first point in the first image;

[0037] The data in the second image is processed as left transition to generate transition data.

[0038] Preferably, the anomaly detection unit is specifically used for:

[0039] Call the learning model;

[0040] Training the learning model using the jump data;

[0041] The new time series data is input into the trained learning model, wherein the trained learning model labels the new time series data to complete anomaly detection.

[0042] A third embodiment of the present invention provides a device for detecting time series jump anomalies, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement a method for detecting time series jump anomalies as described in any one of the above items.

[0043] The present invention provides a method, device and equipment for detecting time series jump anomalies. The original time series data is preprocessed, the processed data is labeled, and then the labeled data is further processed to generate jump data. The machine learning (deep learning) model is trained with the jump data. The trained model can label new time series data to complete anomaly detection, thereby solving the problem in the prior art that the model training time is long and various time series cannot be efficiently identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic flow chart of a method for detecting time series jump anomaly provided by the first embodiment of the present invention;

[0045] Figure 2 It is a schematic diagram of the original time series data provided by the present invention;

[0046] Figure 3-5 is a schematic diagram of the data processing process of the first image provided by the present invention;

[0047] Figure 6 1 is a schematic diagram of a device module for detecting time series jump anomaly provided by a second embodiment of the present invention; DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0050] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0052] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0053] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0054] The "first\second" mentioned in the embodiments is only to distinguish similar objects, and does not represent a specific order for the objects. It is understandable that the "first\second" can be interchanged with the specific order or sequence where permitted. It should be understood that the objects distinguished by "first\second" can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than those illustrated or described herein.

[0055] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0056] The present invention discloses a method, device and equipment for detecting time series jump anomaly, aiming to improve the problem in the prior art that the model training time is long and various time series cannot be efficiently identified.

[0057] See also Figure 1 The first embodiment of the present invention provides a method for detecting time series jump anomaly, which can be performed by a device for detecting time series jump anomaly (hereinafter referred to as a detection device), in particular, by one or more processors in an upgrade device to implement the following steps:

[0058] S101, obtain the original time series data (such as Figure 2 As shown), and preprocessing the original time series data to generate a first image in a preset format;

[0059] In this embodiment, the detection device may be located in a terminal device or a server in the cloud, and is used to annotate new time series data when it is received, so as to detect anomalies in the data.

[0060] Particularly, in this embodiment, the detection device may store data for performing anomaly detection, and a detection instruction may be sent to the detection device so that the detection device starts performing anomaly detection on new time series data.

[0061] In this embodiment, original time series data is obtained;

[0062] and performing local normalization processing on the original time series data for each time period to generate a first image in a preset format;

[0063] Specifically, for example, the data value of each time point is classified into the interval (0, 30), and each frame (30 points) is converted into a picture format data of size 30*30. Of course, in other embodiments, the data of each time point can also be classified into different intervals and converted into different picture formats, which is not specifically limited here, but these solutions are all within the protection scope of the present invention.

[0064] S102, dividing the first image according to the data shape in the first image, and marking the part with jump;

[0065] It should be noted that the data shape in the first image may include one or more of a normal part, a jump part, an abnormal part and a large noise part, wherein the data in the first image may be sound data (not specifically limited here), for example, a sound collection device is used to detect the sound emitted by a running machine, and the jump part refers to the abnormal sound that the running machine may emit at a specific moment, which can be used to determine if the machine has an operating failure.

[0066] S103, moving the transition part to the middle position of the first image, and processing the transition part into a left transition to generate transition data;

[0067] Specifically, in this embodiment, please refer to Figures 3 to 5 ;

[0068] The horizontal coordinate of the center point of the jump part is obtained; wherein the center point of the jump part can be the horizontal coordinate of the point closest to the middle horizontal line. Of course, the center point can also adopt other definitions, which are not specifically limited here.

[0069] The jump portion is moved until the horizontal coordinate of the center point is the middle position of the first image, thereby generating a second image; it can be understood that the center point in the second image is located at the center position of the image.

[0070] The blank part in the second image is filled with the numerical vertical coordinate of the first point in the first image; wherein the blank part is an area without grid data distribution.

[0071] The data in the second image is processed as left transition to generate transition data.

[0072] It should be noted that by processing all the data in the second image as left jumps and generating jump data, left and right jumps in the image are avoided, which is not conducive to the model's feature capture. Processing all data as left jumps can save model training time. In other embodiments, all data in the second image can also be processed as right jumps. No specific limitation is made here, but these schemes are within the scope of protection of the present invention.

[0073] S104: labeling the new time series data according to the jump data to complete anomaly detection.

[0074] Specifically, in this embodiment, the learning model is called;

[0075] Training the learning model using the jump data;

[0076] The new time series data is input into the trained learning model, wherein the trained learning model labels the new time series data to complete anomaly detection.

[0077] The method for detecting time series jump anomalies provided in this embodiment improves the generalization ability of the existing model, and can better mark the jumps of relatively random time series that have never appeared. The marking results are highly accurate and will not cause the problem of missing labels. During use, no specific data is required for real-time training, which reduces latency.

[0078] See also Figure 6 The second embodiment of the present invention provides a device for detecting time series jump anomaly, comprising:

[0079] A first image generation unit 201 is used to obtain original time series data and pre-process the original time series data to generate a first image in a preset format;

[0080] A labeling unit 202, configured to divide the first image according to the data shape in the first image, and label the part with jump;

[0081] The transition data generating unit 203 is used to move the transition part to the middle position of the first image, and process the transition part into a left transition to generate transition data;

[0082] The anomaly detection unit 204 is used to mark the new time series data according to the jump data to complete anomaly detection.

[0083] Preferably, the first image generating unit is specifically used for:

[0084] Get the original time series data;

[0085] The original time series data is locally normalized to obtain the data at each time point, so as to generate a first image in a preset format.

[0086] Preferably, the transition data generating unit is specifically used for:

[0087] Obtaining the horizontal coordinate of the center point of the jump part;

[0088] Moving the jump portion until the horizontal coordinate of the center point is the middle position of the first image, thereby generating a second image;

[0089] Filling the blank part in the second image with the numerical ordinate of the first point in the first image;

[0090] The data in the second image is processed as left transition to generate transition data.

[0091] Preferably, the anomaly detection unit is specifically used for:

[0092] Call the learning model;

[0093] Training the learning model using the jump data;

[0094] The new time series data is input into the trained learning model, wherein the trained learning model labels the new time series data to complete anomaly detection.

[0095] A third embodiment of the present invention provides a device for detecting time series jump anomalies, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement a method for detecting time series jump anomalies as described in any one of the above items.

[0096] The present invention provides a method, device and equipment for detecting time series jump anomalies. The original time series data is preprocessed, the processed data is labeled, and then the labeled data is further processed to generate jump data. The machine learning (deep learning) model is trained with the jump data. The trained model can label new time series data to complete anomaly detection, thereby solving the problem in the prior art that the model training time is long and various time series cannot be efficiently identified.

[0097] Exemplarily, the computer program described in the third embodiment and the fourth embodiment of the present invention can be divided into one or more modules, and the one or more modules are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the device for implementing a time series jump anomaly detection. For example, the device described in the second embodiment of the present invention.

[0098] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the method for detecting anomalies in time series jumps, and uses various interfaces and lines to connect the various parts of the method for detecting anomalies in time series jumps.

[0099] The memory can be used to store the computer program and / or module, and the processor realizes various functions of a method for detecting time series jump anomaly by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, a text conversion function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, text message data, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0100] Wherein, if the implemented module is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0101] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0102] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for detecting time series jump anomalies, Features ,include: Acquiring original time series data, and preprocessing the original time series data to generate a first image in a preset format; Dividing the first image according to the data shape in the first image, and marking the part with jump; Moving the transition part to the middle position of the first image, and processing the transition part into a left transition to generate transition data; According to the jump data, the new time series data is labeled to complete anomaly detection; The obtaining of original time series data and preprocessing of the original time series data to generate a first image in a preset format is specifically: Get the original time series data; and performing local normalization processing on the original time series data for each time period to generate a first image in a preset format; wherein the data in the first image is sound data; The first image of the preset format is: returning the data value of each time point to the interval (0, m), and converting every n time points into a picture format data of size m*n, until the original time series data is processed to obtain the first image; wherein m and n are values ​​greater than 0; The step of moving the transition part to the middle position of the first image and processing the transition part into a left transition to generate the transition data is specifically: Obtaining the horizontal coordinate of the center point of the jump part; Moving the jump portion until the horizontal coordinate of the center point is the middle position of the first image, thereby generating a second image; Filling the blank part in the second image with the numerical ordinate of the first point in the first image; The data in the second image is processed as left transition to generate transition data.

2. According to the method for detecting time series jump anomaly according to claim 1, Features ,The data shape in the first image includes a normal part, a jump part, an abnormal part and a large noise part.

3. According to the method for detecting time series jump anomaly according to claim 1, Features ,The new time series data is labeled according to the jump data to complete the anomaly detection specifically as follows: Call the learning model; Training the learning model using the jump data; The new time series data is input into the trained learning model, wherein the trained learning model labels the new time series data to complete anomaly detection.

4. A device for detecting abnormal jumps in time series, Features ,include: A first image generating unit, used for acquiring original time series data and preprocessing the original time series data to generate a first image in a preset format; a marking unit, configured to divide the first image according to the data shape in the first image, and mark the part with jump; A transition data generating unit, used for moving the transition part to the middle position of the first image, and processing the transition part into a left transition, so as to generate transition data; An anomaly detection unit, used to mark the new time series data according to the jump data to complete anomaly detection; Wherein, the first image generating unit is specifically used for: Get the original time series data; and performing local normalization processing on the original time series data for each time period to generate a first image in a preset format; wherein the data in the first image is sound data; The first image of the preset format is: returning the data value of each time point to the interval (0, m), and converting every n time points into a picture format data of size m*n, until the original time series data is processed to obtain the first image; wherein m and n are values ​​greater than 0; The jump data generating unit is specifically used for: Obtaining the horizontal coordinate of the center point of the jump part; Moving the jump portion until the horizontal coordinate of the center point is the middle position of the first image, thereby generating a second image; Filling the blank part in the second image with the numerical ordinate of the first point in the first image; The data in the second image is processed as left transition to generate transition data.

5. According to the device for detecting time series jump anomaly according to claim 4, Features , the anomaly detection unit is specifically used for: Call the learning model; Training the learning model using the jump data; The new time series data is input into the trained learning model, wherein the trained learning model labels the new time series data to complete anomaly detection.

6. A device for detecting abnormal changes in time series. It is characterized in that The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement a method for detecting time series jump anomalies as claimed in any one of claims 1 to 3.

Images