Multivariate KPI time series anomaly detection method and system based on multi-angle features

Abstract

The present invention provides a multivariate KPI time series anomaly detection method and system based on multi-angle features, belonging to the field of KPI anomaly detection. The method extracts the features of KPI time series from three angles: embedded graph, time domain, and frequency domain, and then uses graph convolutional neural network, time domain convolutional neural network, and spectral network to perform data feature learning representation on the three features, and then uses fully connected neural network and Softmax function to obtain the attention score of each feature, and fuses different feature representations according to the attention score, and then inputs them into the decoder to obtain the reconstruction representation of the original data, forming a complete multivariate KPI time series anomaly detection model; after the model training is completed based on historical data, the multivariate KPI time series to be detected is input into a mature detection model to detect whether there is anomaly in the data. The present invention does not require manual annotation of anomalies, reduces the manpower demand in the detection process, and improves the accuracy and efficiency of anomaly detection in the operation and maintenance management system.

Description

Technical Field

[0001] The present invention belongs to the field of KPI time series data mining, and in particular relates to an anomaly detection method and system for multivariate KPI time series based on multi-angle features. Background Art

[0002] With the rapid development of the Internet, especially mobile Internet, Internet services have penetrated into all areas of society. People use the Internet for search, shopping, entertainment and other activities. Therefore, it is increasingly important to ensure the stability of Internet services. The stability of Internet services is mainly guaranteed by operation and maintenance. Operation and maintenance personnel monitor various key performance indicators (KPIs) to determine whether Internet services are stable. By continuously monitoring KPIs, KPI time series data is obtained. When anomalies are detected in the monitored KPI time series data, it can be concluded that anomalies have occurred in the related applications.

[0003] In some complex network elements, there may be thousands of KPIs. These KPI time series usually have different types, including periodic, stable, non-stationary, and continuously fluctuating types. There are many corresponding data anomaly types. Moreover, KPI time series are often accompanied by uncertain noise, which increases the difficulty of identifying abnormal and normal data. Especially when real-time anomaly detection is required, it is difficult for humans to quickly and accurately identify anomalies, making multivariate KPI anomaly detection a challenging task.

[0004] In the prior art, anomalies are generally identified by building a KPI anomaly detection model, including statistical methods, machine learning methods, and deep learning methods. Among them, statistical methods will learn a generative model that fits a given data set, and then identify objects in the low-probability area of ​​the model and treat them as anomalies, such as parameter estimation methods based on multivariate normal distribution, non-parametric estimation methods based on histogram anomaly value scores, etc.; the limitation of this type of method is that it relies heavily on premise assumptions and is difficult to process multivariate KPI time series data. Machine learning methods usually need to extract a large number of features, and then input these features into powerful classifiers, such as tree-based random forests, clustering-based support vector data descriptions, distance-based K nearest neighbor algorithms, etc.; but machine learning methods are difficult to extract high-dimensional and complex features due to their overly simple models, and cannot process high-dimensional data. The deep learning method is to distinguish anomalies by learning the normal patterns of data. However, although the current multivariate KPI time series anomaly detection method based on deep neural networks does not require any assumptions about the data, and the deep supervision model used for feature engineering and anomaly recognition can also process high-dimensional data, it is easy to cause the model to converge to a suboptimal state due to the imbalance of data samples. At the same time, the deep supervision model requires manual work to find a small number of abnormal samples from a large number of samples for labeling, which will lead to a large loss of human resources. Summary of the invention

[0005] In view of the above problems, an embodiment of the present invention provides a multi-dimensional KPI time series anomaly detection method and system based on multi-angle features to improve the accuracy and efficiency of anomaly detection in the operation and maintenance management system, while eliminating the need for manual labeling of anomalies to reduce human resource consumption in the detection process.

[0006] The technical solution adopted in the embodiment of the present invention is as follows:

[0007] In a first aspect, an embodiment of the present invention provides an anomaly detection method for a multivariate KPI time series based on multi-angle features, wherein the number of the KPI time series is set to M, and the method comprises the following steps:

[0008] Step S1, analyzing the structure of M-element KPI time series data, extracting embedded graph features, constructing a graph convolutional neural network GCN for multivariate KPI time series anomaly detection based on the embedded graph features, and characterizing the information representation between different variables of the multivariate KPI time series;

[0009] Step S2, using the M-element KPI time series data itself as the time domain feature, and constructing a time domain convolutional neural network TCN for multivariate KPI time series anomaly detection based on the time domain feature, so as to obtain the historical information representation of the multivariate KPI time series data in the time domain;

[0010] Step S3, determining the real part and the imaginary part of the frequency domain features of the M-element KPI time series data respectively based on Fourier transform, and constructing a spectral network for anomaly detection of multivariate KPI time series data based on the frequency domain features to obtain information representation on the multivariate KPI time series period;

[0011] Step S4, fusing the feature representations of the GCN, TCN and spectral network outputs of the constructed multivariate KPI time series anomaly detection to construct a multivariate KPI time series anomaly detection model based on multi-angle features;

[0012] Step S5, collecting M-element KPI time series historical data within a predetermined time period, dividing the data into a training set and a validation set after data preprocessing, training the anomaly detection model with the training set, and after the training is completed and verified with the validation set, a mature multivariate KPI time series anomaly detection model is obtained;

[0013] Step S6, setting a threshold, performing data preprocessing on the M-element KPI time series to be detected, inputting the data into the mature multivariate KPI time series anomaly detection model, and outputting the multivariate KPI time series anomaly detection result.

[0014] As a preferred embodiment of the present invention, the fusion in step S4 includes the following steps:

[0015] Step S41, respectively mapping the output results of GCN, TCN and spectral network into a one-dimensional feature vector through a fully connected neural network FCN;

[0016] Step S42, a connection layer is set between the three FCNs, and the embedded graph features, time domain features and frequency domain features are mapped to the (0, 1) interval through the connection layer through the output of the FCN, and the mapping result is used as the category probability distribution, and the obtained probability map is used as the attention score of each feature;

[0017] Step S43, fusing the attention score and the feature representations output by the three anomaly detection networks, and inputting the fusion result into the decoder to reconstruct the multivariate KPI time series data, and setting the mean square error MSE between the multivariate KPI time series and the reconstructed data as the anomaly score result;

[0018] Step S44, in the constructed multivariate KPI time series anomaly detection model based on multi-angle features, a threshold is set again, and by comparing the threshold with the anomaly score result, it is determined whether there is an anomaly in the current multivariate KPI time series.

[0019] As a preferred embodiment of the present invention, the attention score is solved using formula (6):

[0020]

[0021] In formula (6), zk represents the output of the current k features after FCN, zi represents the output of any i features among the K features after FCN, and K represents the number of features.

[0022] As a preferred embodiment of the present invention, in step S43:

[0023] The attention score and the feature representation of the output of the three anomaly detection networks are fused using formula (7):

[0024]

[0025] In formula (7), represents the product symbol, z i ′ represents the feature representations obtained from GCN, TCN, and spectral network, respectively, and z i It is the output of the three features in formula (6) after FCN;

[0026] Then input Z into the decoder to obtain the reconstructed representation of the original data. Suppose the input multivariate KPI time series is where x i ∈R m (i=1,…,n), that is, there are m KPI time series, and the length of each KPI time series is n; then the reconstructed multivariate KPI time series is expressed as x′ i ∈R m (i=1,…,n); mean square error MSE is used as the multivariate KPI time series x at time t t The anomaly score of is solved using formula (8):

[0027]

[0028] In formula (8), x ti Represents the observed value of the i-th variable in the multivariate KPI time series at time t.

[0029] As a preferred embodiment of the present invention, the embedded graph features are extracted in step S1, and the specific process is as follows: the window size l of the sliding time window is used as the basic structural unit length in the M-element KPI time series data, the data size in a basic structural unit is m×l, and each variable in the window is used as the node vector of the graph to form an m×l-dimensional matrix X as the node feature of the graph; the inner product of each pair of node vectors is used as the weight of the edge between each pair of nodes, and the Top-K sparse graph structure is used to obtain the m×m-dimensional adjacency matrix A as the edge feature of the graph.

[0030] As a preferred embodiment of the present invention, the GCN for multivariate KPI time series anomaly detection is constructed, and the embedded graph features of each layer of nodes in the GCN are updated according to formula (1):

[0031]

[0032] In formula (1), represents the feature representation of node j at layer Q, c ij is the normalization factor, Ni represents the set of nodes i and its neighbor nodes, w is a learnable parameter in the network, and σ is an optional activation function;

[0033] According to the adjacency matrix A, formula (1) is simplified to formula (2):

[0034] H (Q+1) =σ(AH (Q) W (Q) ) (2)

[0035] Where A is the adjacency matrix; the matrix W∈R l×l , is the learnable parameter in the network, and the output result H of the final Nth layer (N) As the final learned feature representation.

[0036] As a preferred embodiment of the present invention, the structure of the FCN includes an input layer, an output layer and multiple hidden layers, the layers between the input layer and the output layer are all hidden layers, each layer of the neural network has a number of neurons, the neurons between layers are interconnected, the neurons within the layer are not connected to each other, and the neurons in the next layer are connected to all the neurons in the previous layer; for the i-th neuron in the l-th hidden layer The input is The output of the neuron Where N is the number of neurons in the previous layer, is the output of the nth neuron in the l-1th layer, w is a learnable parameter, and σ is the activation function of the neuron.

[0037] As a preferred embodiment of the present invention, in step S5, during model verification, the F1 score is selected as the model evaluation index, where F1 is the weighted average of the model accuracy and recall, the maximum value is 1, the minimum value is 0, and the calculation formula is F1=2*PR / (P+R); wherein P represents the accuracy, and the calculation formula is P=TP / (TP+FP), R=TP / (TP+FN) represents the recall rate, TP represents the number of outliers marked as outliers, FP is the number of normal values ​​marked as outliers, and FN is the number of outliers marked as normal; the model with the largest F1 score is taken as the mature model, and the maximum value of the anomaly score on the verification set is taken as the threshold of the detection stage in step S6.

[0038] As a preferred embodiment of the present invention, the multivariate KPI time series anomaly detection result is output in step S6, which specifically includes: inputting the multivariate KPI time series to be detected after data preprocessing into a mature detection model, comparing the obtained anomaly score with the threshold, and marking the abnormal point if it exceeds the threshold.

[0039] In a second aspect, an embodiment of the present invention further provides an anomaly detection system for a multivariate KPI time series based on multi-angle features, the system comprising: an embedded graph feature extraction module, a GCN construction module, a time domain feature extraction module, a TCN construction module, a frequency domain feature extraction module, a spectral network construction module, a network fusion and model construction module, a KPI time series storage module, and a detection result output module; wherein,

[0040] The embedded graph feature extraction module is used to extract embedded graph features based on the structure of M-element KPI time series data, and send the embedded graph features to the GCN construction module;

[0041] The GCN building module is used to build a graph convolutional neural network GCN for multivariate KPI time series anomaly detection based on embedded graph features, and to characterize the information representation between different variables of the multivariate KPI time series;

[0042] The time domain feature extraction module is used to obtain the time domain features based on the M-element KPI time series data itself and send it to the TCN construction module;

[0043] The TCN construction module is used to construct a time domain convolutional neural network TCN for multivariate KPI time series anomaly detection based on time domain features to obtain historical information representation of multivariate KPI time series data in the time domain;

[0044] The frequency domain feature extraction module is used to determine the real part and the imaginary part of the frequency domain feature of the M-element KPI time series data based on Fourier transform, and send them to the spectrum network construction module;

[0045] The spectral network construction module is used to construct a spectral network for multivariate KPI time series data anomaly detection based on frequency domain features to obtain information representation on the multivariate KPI time series period;

[0046] The network fusion and model building module is used to fuse the feature representations of the GCN, TCN and spectral network outputs of the constructed multivariate KPI time series anomaly detection, and to build a multivariate KPI time series anomaly detection model based on multi-angle features, and to complete the training and verification of the model to obtain a mature multivariate KPI time series anomaly detection model;

[0047] The KPI time series storage module is used to collect training set and validation set data of the multivariate KPI time series anomaly detection model, and is also used to collect M-element KPI time series to be detected, and store the collected data after preprocessing;

[0048] The detection result output module is used to output the detection result of the model after inputting the M-element KPI time series to be detected into the mature multi-element KPI time series anomaly detection model.

[0049] The present invention has the following beneficial effects:

[0050] The anomaly detection method and system for multivariate KPI time series based on multi-angle features provided in the embodiments of the present invention can effectively perform efficient and accurate anomaly detection on KPI time series data with multiple types, integrate information from multiple angles, and improve the reliability of the detection results. This method is an unsupervised learning method, which does not require manual labeling of abnormal samples, nor does it require a large amount of feature extraction. It is suitable for scenarios with multiple types of KPI time series data and sample imbalance. This method also effectively solves the problem of the curse of dimensionality, and can still efficiently and accurately detect anomalies for high-dimensional KPI time series data. The present invention provides a visualization system to display the original time series, the extracted different feature data, and the anomalies marked to the system operation and maintenance personnel, so that the operation and maintenance personnel can easily identify the type of anomalies and locate the anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0052] Figure 1 A flow chart of a multivariate KPI time series anomaly detection method based on multi-angle features proposed in an embodiment of the present invention;

[0053] Figure 2 It is the embedding graph feature representation process in the embodiment of the present invention;

[0054] Figure 3 This is the information propagation process of the graph convolutional neural network (GCN) in the embodiment of the present invention;

[0055] Figure 4 It is the information propagation process of the temporal convolutional neural network (TCN) in the embodiment of the present invention;

[0056] Figure 5 The process of converting the time domain into the frequency domain in the embodiment of the present invention;

[0057] Figure 6 This is the information propagation process of a fully connected neural network (FCN) in an embodiment of the present invention;

[0058] Figure 7 This is a data transmission principle diagram of a multivariate KPI time series input anomaly detection model in an embodiment of the present invention;

[0059] Figure 8 It is a structural schematic diagram of a multi-element KPI time series input anomaly detection system based on multi-angle features according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] Below, by referring to exemplary embodiments, and in conjunction with the accompanying drawings, the technical problems, technical solutions and advantages of the present invention are explained in detail. The exemplary embodiments described below are only used to explain the present invention and cannot be interpreted as limiting the present invention. It can be understood by those skilled in the art that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as the general understanding of ordinary technicians in the field to which the present invention belongs. It should also be understood that those terms such as those defined in general dictionaries should be understood to have a meaning consistent with the meaning in the context of the prior art, and unless defined here, will not be interpreted with an idealized or overly formal meaning.

[0061] After detailed research, the inventors of this application found that there is currently no anomaly detection method specifically for different types of multivariate KPI time series data. When there are multiple types of KPI time series data and it appears multivariate, effective detection cannot be performed. Based on this, the embodiment of this application proposes a method and system for multivariate KPI time series anomaly detection based on multi-angle features. It does not require manual labeling of abnormal samples, nor does it require a large amount of feature extraction. It parallelizes the high-dimensional KPI time series data from multiple angles such as time domain information, inter-variable information, and frequency domain information, extracts complex features on the KPI time series data to improve the reliability of detection, and is suitable for KPI anomaly detection in high-dimensional KPI time series data and when samples are unbalanced, and improves detection accuracy.

[0062] See also Figure 1 The embodiment of the present invention provides a multivariate KPI time series anomaly detection method based on multi-angle features, setting the number of KPI time series as M, comprising the following steps:

[0063] Step S1, analyze the structure of M-element KPI time series data, extract embedded graph features, build a graph convolutional neural network (GCN) for multivariate KPI time series anomaly detection based on the embedded graph features, and characterize the information representation between different variables of the multivariate KPI time series.

[0064] In this step, the embedding graph features are extracted, such as Figure 2 As shown in the figure, the specific process is as follows: the window size l of the sliding time window is used as the basic structural unit length in the M-element KPI time series data, the data size in a basic structural unit is m×l, and each variable in the window is used as the node vector of the graph to form an m×l-dimensional matrix X as the node feature of the graph; the connection between each pair of nodes is used as the edge, the inner product of each pair of node vectors is used as the weight of the edge between nodes, and the Top-K sparse graph structure is used to obtain the m×m-dimensional adjacency matrix A as the edge feature of the graph; the matrix X and A are stored in the database.

[0065] The embedded graph features extracted above have two basic characteristics: (1) Each node has its own feature information; (2) Each node in the embedded graph also has structural information. Based on this, a GCN for multi-KPI time series anomaly detection is constructed. GCN has the following characteristics: (1) Each node is emitted, its own feature information is sent to the neighboring nodes after transformation, and the feature information of the node is extracted and transformed; (2) Each node is accepted, the feature information of the neighboring nodes is gathered, and the local structural information of the node is fused; (3) After aggregating the previous information, a nonlinear transformation is performed to increase the expression ability of the model. Based on this, a GCN for multi-KPI time series anomaly detection is constructed in this embodiment, such as Figure 3 As shown, the embedded graph features of the nodes in each layer of GCN are updated according to formula (1):

[0066]

[0067] in, represents the feature representation of node j at layer Q, c ij is the normalization factor, N i represents the set of node i itself and its neighbor nodes, w is a learnable parameter in the network, and σ is an optional activation function.

[0068] According to the adjacency matrix A, equation (1) is simplified to equation (2):

[0069] H (Q+1) =σ(AH (Q) W (Q) ) (2)

[0070] Where A is the adjacency matrix; the matrix W∈R l×l , is a learnable parameter in the network. When Q = 0, H (0) =X, the output result of the last Nth layer is H (N) As the final learned feature representation.

[0071] Step S2, using the M-element KPI time series data itself as the time domain feature, and constructing a time domain convolutional network (TCN) for multivariate KPI time series anomaly detection based on the time domain feature to obtain the historical information representation of the multivariate KPI time series data in the time domain.

[0072] In this step, TCN is used to process time domain information, combining the modeling capability in the time domain with the feature extraction capability of convolution with low parameters, and can capture the dependencies in time series. At the same time, by using convolution, local information can be captured. Set the expansion rate d and the filter F = {f1, f2, ..., f k}, = 3 for the i-th KPI time series like Figure 4 As shown, when k=3, information propagation is performed according to formula (3):

[0073]

[0074] Finally, the time domain feature representation is obtained

[0075] Step S3, based on Fourier transform, respectively determine the real part and imaginary part of the frequency domain characteristics of the M-ary KPI time series data, and construct a spectral network for anomaly detection of multivariate KPI time series data based on the frequency domain characteristics to obtain information representation on the multivariate KPI time series period.

[0076] In this step, if Figure 5As shown, the real part and imaginary part of the frequency domain characteristics of the M-element KPI time series data are determined based on Fourier transform. During the Fourier transform process, a signal contains multiple frequency components. Any signal can be synthesized by adding multiple periodic functions (basis functions). The Fourier transform adopts formula (4):

[0077]

[0078] In formula (4), s represents frequency, t represents time, and e -ist is a complex function.

[0079] Through Fourier transform, the signal in the time domain is converted into a signal in the frequency domain. With the difference of domains, the periodic information contained in the multivariate KPI time series can be obtained to improve the reliability of subsequent anomaly detection.

[0080] The spectral network for anomaly detection of multivariate KPI time series data based on frequency domain features is constructed. In order to consider the periodic information on the KPI time series, both the real and imaginary parts of the frequency domain features are used as inputs of the spectral network. The spectral network includes an FCN, namely a linear layer and a Sigmoid activation layer. The linear layer is used to learn the characteristics of frequency domain information, but its output result may be negative, so the Sigmoid function is used to correct the output result. The Sigmoid function formula (5) is:

[0081] Sigmoid(z)=1 / (1+e -z ) (5)

[0082] In formula (5), z represents the output of the linear layer.

[0083] Step S4, fusing the feature representations of the GCN, TCN and spectral network outputs of the constructed multivariate KPI time series anomaly detection, and constructing a multivariate KPI time series anomaly detection model based on multi-angle features.

[0084] In this step, the fusion comprises the following steps:

[0085] Step S41, respectively map the output results of GCN, TCN and spectral network into a one-dimensional feature vector through the output of an FCN.

[0086] In this step, if Figure 6 As shown in the figure, the structure of the FCN includes an input layer, an output layer and multiple hidden layers, and the layers between the input layer and the output layer are all hidden layers. Each layer of the neural network has a number of neurons, and the neurons between layers are interconnected. The neurons within a layer are not connected to each other, and the neurons in the next layer are connected to all the neurons in the previous layer. For example, for the i-th neuron in the l-th hidden layer The input is The output of the neuron Where N is the number of neurons in the previous layer, is the output of the nth neuron in the l-1th layer, w is a learnable parameter, and σ is the activation function of the neuron. Through the nonlinear fitting of FCN, the feature representation is better learned, and the output of the model is also convenient for the subsequent activation function Softmax to process.

[0087] Step S42, a connection layer is set between the three FCNs, and the embedded graph features, time domain features and frequency domain features are mapped to the (0, 1) interval through the connection layer through the output of FCN, and the mapping result is used as the category probability distribution, and the obtained probability map is used as the importance of each feature, that is, the attention score. The attention score formula (6) is:

[0088]

[0089] In formula (6), z k Indicates the output of the current k features after FCN, z i It represents the output of any i feature among the K features after FCN, and K represents the number of features. In this embodiment, K=3.

[0090] Step S43, fuse the attention score and the feature representation output by the three anomaly detection networks, input the fusion result into the decoder to reconstruct the multivariate KPI time series data, and set the mean square error MSE between the multivariate KPI time series and the reconstructed data as the anomaly score result.

[0091] In this step, the attention scores and the feature representations output by the three anomaly detection networks are fused using formula (7):

[0092]

[0093] In formula (7), represents the product symbol, z i ′ represents the feature representations obtained from GCN, TCN, and spectral network, respectively, and z i It is the output of the three features mentioned in formula (6) after passing through the FCN network.

[0094] Then input Z into the decoder to obtain the reconstructed representation of the original data. Suppose the input multivariate KPI time series is where x i ∈R m (i=1, ..., n), that is, there are m KPI time series, and the length of each KPI time series is n. Then the reconstructed multivariate KPI time series is expressed as x′ i ∈R m (i=1,…,n); mean square error (MSE) as the multivariate KPI time series x at time tt The anomaly score of is solved as follows:

[0095]

[0096] In formula (8), x ti Represents the observed value of the i-th variable in the multivariate KPI time series at time t.

[0097] Step S44, in the constructed multivariate KPI time series anomaly detection model based on multi-angle features, a threshold is set again, and by comparing the threshold with the anomaly score result, it is determined whether there is an anomaly in the current multivariate KPI time series.

[0098] Step S5, collect M-element KPI time series historical data within a predetermined time period, divide the data into a training set and a validation set after data preprocessing, train the anomaly detection model with the training set, and after the training is completed and verified with the validation set, obtain a mature multivariate KPI time series anomaly detection model.

[0099] In this step, if Figure 7 As shown in the figure, when training with the training set, the current M-ary KPI data is input into the GCN, TCN and spectral network for anomaly detection respectively. The three output results are output by FCN and then normalized by the Softmax connection layer to obtain different attention scores of the three angle features; then the M-ary KPI time series is reconstructed and the MSE is calculated. According to the result of MSE, the parameters of GCN, TCN, spectral network, FCN, connection layer and decoder are adjusted, such as the weights between the layers in the network; after the adjustment is completed, when the verification set is used for verification, the anomaly score when the F1 score is the largest is selected as the threshold of step S6.

[0100] For example, after data preprocessing, we can get the multivariate KPI time series For example, input it into GCN, such as Figure 3 As shown, assuming that the size of the sliding window is l, a = [a1, a2..., a l ],b=[b1,b2…,b l ] are any two nodes in the graph, then the edge e connecting nodes a and b ab The weights are: After calculating the inner product of all node pairs, a fully connected graph will be obtained. In order to reduce the computational overhead and prevent overfitting during subsequent model training, the ToP-K method is used to ensure the sparse rows of the embedded graph. That is, for a node, the weights on its adjacent edges are sorted from large to small, and only the first K edges with the largest weights are retained. In practical applications, the value of K can be determined based on the business scenario. Figure 5As shown in Figure 2, the matrix X composed of the node vectors obtained above is used as the 0th layer feature representation of GCN, and then information is propagated in the graph convolution layer according to formula (1).

[0101] When verifying the model, the F1 score is selected as the model evaluation indicator. F1 can be regarded as a weighted average of the model's accuracy and recall. Its maximum value is 1 and its minimum value is 0. The larger the value, the better the model. Its calculation formula is F1=2*PR / (P+R). P represents the accuracy, and the calculation formula is P=TP / (TP+FP). R=TP / (TP+FN) represents the recall rate. TP represents the number of outliers marked as outliers, FP represents the number of normal values ​​marked as outliers, and FN represents the number of outliers marked as normal. The model with the largest F1 score is taken as the mature model. At this time, the maximum value of the anomaly score on the validation set is used as the threshold for the detection stage in step S6.

[0102] The purpose of data preprocessing is to process the data into a form that is convenient for input into the neural network, including: data extraction, missing value processing, and data normalization. After preprocessing, the multivariate KPI time series is obtained

[0103] Among them, data extraction is to adjust the format of the original multivariate KPI time series data to a unified format, adjust the data timestamp and remove duplicate data, solve the problem of irregular data timestamp order, and sort it from small to large by timestamp. The multivariate KPI time series after data extraction contains the following attribute fields: timestamp, time series value.

[0104] Missing value processing is to use linear interpolation to supplement missing data points; the specific processing process is as follows: first, the sampling interval of the data is obtained according to the original multivariate KPI time series, and then based on the sampling interval, the number of data points that should be in the time interval of the multivariate KPI time series, the actual number of data points, and the number of missing data points are determined and obtained; on the basis of the existing data points, the missing data points at the corresponding time points are processed for missing values, and the missing data points are supplemented by linear interpolation.

[0105] Data normalization is to perform min-max normalization processing on multivariate KPI time series. The specific processing formula is:

[0106] x ij ′=(x ij -min(x .j )) / (max(x .j )-min(x .j )) (8)

[0107] In formula (8), i=1, 2, ..., n, j=1, 2, ..., m.

[0108] Step S6, setting a threshold, performing data preprocessing on the M-element KPI time series to be detected, inputting the data into the mature multivariate KPI time series anomaly detection model, and outputting the multivariate KPI time series anomaly detection result.

[0109] In this step, the multivariate KPI time series to be detected after data preprocessing is input into a mature detection model, and the obtained anomaly score is compared with the threshold. Those exceeding the threshold are marked as anomalies. In actual situations, new multivariate KPI time series data often contain some features or anomalies that have not appeared in historical data. At this time, system operation and maintenance personnel are required to fine-tune the threshold in the proposed system. Analyze the multivariate KPI time series from three feature perspectives and extract the implicit information in the data to improve the accuracy and precision of anomaly detection.

[0110] It can be seen from the above technical solutions that the anomaly detection method of a multivariate KPI time series based on multi-angle features described in an embodiment of the present invention can effectively detect anomalies of various types of multivariate KPI time series such as stationary, non-stationary, and periodic types from the perspective of time domain information, inter-variable information, and frequency domain information, and can improve the reliability of detection. This method is an unsupervised learning method. This method uses an unsupervised method and does not require manual labeling of abnormal samples or a large amount of feature extraction. It is applicable to various types of multivariate KPI time series data and scenarios with unbalanced samples. This method also effectively solves the problem of the dimensionality disaster, and can still efficiently and accurately detect anomalies for high-dimensional KPI time series data. The present invention provides a visualization system to display the original time series, extracted different feature data, and annotated anomalies to system operation and maintenance personnel, making it convenient for operation and maintenance personnel to identify anomaly types and locate anomalies.

[0111] Based on the same idea, the embodiment of the present invention also provides an anomaly detection system for multivariate KPI time series based on multi-angle features, see Figure 8 The system includes: an embedded graph feature extraction module, a GCN construction module, a time domain feature extraction module, a TCN construction module, a frequency domain feature extraction module, a spectral network construction module, a network fusion and model construction module, a KPI time series storage module and a detection result output module.

[0112] The embedded graph feature extraction module is used to extract embedded graph features based on the structure of M-element KPI time series data, and send the embedded graph features to the GCN construction module;

[0113] The GCN building module is used to build a graph convolutional neural network GCN for multivariate KPI time series anomaly detection based on embedded graph features, and to characterize the information representation between different variables of the multivariate KPI time series;

[0114] The time domain feature extraction module is used to obtain the time domain features based on the M-element KPI time series data itself and send them to the TCN construction module;

[0115] The TCN construction module is used to construct a time domain convolutional neural network TCN for multivariate KPI time series anomaly detection based on time domain features to obtain historical information representation of multivariate KPI time series data in the time domain;

[0116] The frequency domain feature extraction module is used to determine the real part and the imaginary part of the frequency domain feature of the M-element KPI time series data based on Fourier transform, and send them to the spectrum network construction module;

[0117] The spectral network construction module is used to construct a spectral network for multivariate KPI time series data anomaly detection based on frequency domain features to obtain information representation on the multivariate KPI time series period;

[0118] The network fusion and model building module is used to fuse the feature representations of the GCN, TCN and spectral network outputs of the constructed multivariate KPI time series anomaly detection, and to build a multivariate KPI time series anomaly detection model based on multi-angle features, and to complete the training and verification of the model to obtain a mature multivariate KPI time series anomaly detection model;

[0119] The KPI time series storage module is used to collect training set and validation set data of the multivariate KPI time series anomaly detection model, and is also used to collect M-element KPI time series to be detected, and store the collected data after preprocessing;

[0120] The detection result output module is used to output the detection result of the model after inputting the M-element KPI time series to be detected into the mature multi-element KPI time series anomaly detection model.

[0121] Preferably, if Figure 8 As shown, the detection system in this embodiment may further include a KPI time series visualization module, which may visualize the original data, normal KPI time series data, and detected abnormal KPI data, thereby more clearly displaying the status of the KPI time series.

[0122] In this embodiment, each module is implemented by a processor, and a memory is appropriately added when storage is required. Among them, the processor can be but is not limited to a microprocessor MPU, a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, etc. The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0123] It should be noted that the anomaly detection system for the multivariate KPI time series based on multi-angle features described in this embodiment corresponds to the anomaly detection method for the multivariate KPI time series based on multi-angle features. The description of the anomaly detection method for the multivariate KPI time series based on multi-angle features is also applicable to the anomaly detection system for the multivariate KPI time series based on multi-angle features, which will not be repeated here. The above is a preferred embodiment of the present invention. It should be pointed out that the present invention is not limited to the exemplary embodiments disclosed above. The essence of the specification is only to help technicians in related fields to comprehensively understand the specific details of the present invention. For ordinary technicians in this technical field, without departing from the principles described in the present invention, several improvements and embellishments made within the technical scope disclosed by the present invention, and changes or replacements that can be easily conceived should all be covered within the scope of protection of the present invention.

Claims

1. A multivariate KPI time series anomaly detection method based on multi-angle features, characterized in that: Operation and maintenance personnel monitor various key performance indicators (KPIs) to determine whether Internet services are stable. By continuously monitoring KPIs, KPI time series data is obtained. When abnormalities are detected in the monitored KPI time series data, it can be concluded that an abnormality has occurred in the related application. The KPI time series is set to M, which includes the following steps: Step S1, analyzing the structure of M-element KPI time series data, extracting embedded graph features, constructing a graph convolutional neural network GCN for multivariate KPI time series anomaly detection based on the embedded graph features, and characterizing the information representation between different variables of the multivariate KPI time series; Step S2, using the M-element KPI time series data itself as the time domain feature, and constructing a time domain convolutional neural network TCN for multivariate KPI time series anomaly detection based on the time domain feature, so as to obtain the historical information representation of the multivariate KPI time series data in the time domain; Step S3, determining the real part and the imaginary part of the frequency domain features of the M-element KPI time series data respectively based on Fourier transform, and constructing a spectral network for anomaly detection of multivariate KPI time series data based on the frequency domain features to obtain information representation on the multivariate KPI time series period; Step S4, fusing the feature representations of the GCN, TCN and spectral network outputs of the constructed multivariate KPI time series anomaly detection to construct a multivariate KPI time series anomaly detection model based on multi-angle features; Step S5, collecting M-element KPI time series historical data within a predetermined time period, dividing the data into a training set and a validation set after data preprocessing, training the anomaly detection model with the training set, and after the training is completed and verified with the validation set, a mature multivariate KPI time series anomaly detection model is obtained; Step S6, setting a threshold, performing data preprocessing on the M-element KPI time series to be detected, inputting the data into the mature multivariate KPI time series anomaly detection model, and outputting the multivariate KPI time series anomaly detection result.

2. The multivariate KPI time series anomaly detection method based on multi-angle features according to claim 1 is characterized in that: The fusion in step S4 comprises the following steps: Step S41, respectively mapping the output results of GCN, TCN and spectral network into a one-dimensional feature vector through a fully connected neural network FCN; Step S42, a connection layer is set between the three FCNs, and the embedded graph features, time domain features and frequency domain features are mapped to the (0, 1) interval through the connection layer through the output of the FCN, and the mapping result is used as the category probability distribution, and the obtained probability map is used as the attention score of each feature; Step S43, fusing the attention score and the feature representations output by the three anomaly detection networks, and inputting the fusion result into the decoder to reconstruct the multivariate KPI time series data, and setting the mean square error MSE between the multivariate KPI time series and the reconstructed data as the anomaly score result; Step S44, in the constructed multivariate KPI time series anomaly detection model based on multi-angle features, a threshold is set again, and by comparing the threshold with the anomaly score result, it is determined whether there is an anomaly in the current multivariate KPI time series.

3. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to claim 2 is characterized in that: The attention score is solved using formula (6): In formula (6), z k Indicates the output of the current k features after FCN, z i It represents the output of any i feature among K features after FCN, where K represents the number of features.

4. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to claim 3 is characterized in that: In step S43: The attention score and the feature representation of the output of the three anomaly detection networks are fused using formula (7): In formula (7), represents the product symbol, z i ′ represents the feature representations obtained from GCN, TCN, and spectral network, respectively, and z i It is the output of the three features in formula (6) after FCN; Then input Z into the decoder to obtain the reconstructed representation of the original data. Suppose the input multivariate KPI time series is where x i ∈R m (i=1,…,n), that is, there are m KPI time series, and the length of each KPI time series is n; then the reconstructed multivariate KPI time series is expressed as χ′={x′1,x′2,…,x′ n }∈R m×n , x′ i ∈R m (i=1,…,n); mean square error MSE as the multivariate KPI time series x at time t t The anomaly score of is solved using formula (8): In formula (8), x ti Represents the observed value of the i-th variable in the multivariate KPI time series at time t.

5. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to any one of claims 1 to 4, characterized in that: In step S1, the embedded graph features are extracted, and the specific process is as follows: the window size l of the sliding time window is used as the basic structural unit length in the M-element KPI time series data, the data size in a basic structural unit is m×l, each variable in the window is used as the node vector of the graph, and an m×l-dimensional matrix X is constructed as the node feature of the graph; Let the inner product of each pair of node vectors be the weight of the edge between each pair of nodes, and use the Top-K sparse graph structure to obtain the m×m dimensional adjacency matrix A as the edge feature of the graph.

6. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to claim 5 is characterized in that: The GCN for multivariate KPI time series anomaly detection is constructed, and the embedded graph features of each layer of nodes in the GCN are updated according to formula (1): In formula (1), represents the feature representation of node j at layer Q, c ij is the normalization factor, N i represents the set of nodes i and its neighbor nodes, w is a learnable parameter in the network, and σ is an optional activation function; According to the adjacency matrix A, formula (1) is simplified to formula (2): H (Q+1) =σ(AH (Q) W (Q) ) (2) In formula (2), A is the adjacency matrix; matrix W∈R l×l , is the learnable parameter in the network, and the output result H of the final Nth layer (N) As the final learned feature representation.

7. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to any one of claims 2 to 4, characterized in that: The structure of the FCN includes an input layer, an output layer and multiple hidden layers. The layers between the input layer and the output layer are all hidden layers. Each layer of the neural network has a number of neurons. The neurons between layers are interconnected, the neurons within a layer are not connected to each other, and the neurons in the next layer are connected to all the neurons in the previous layer. For the i-th neuron in the l-th hidden layer The input is The output of the neuron is Where N is the number of neurons in the previous layer, is the output of the nth neuron in the l-1th layer, w is a learnable parameter, and σ is the activation function of the neuron.

8. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to any one of claims 1 to 4, characterized in that: In step S5, during model verification, the F1 score is selected as the model evaluation indicator. F1 is the weighted average of the model accuracy and recall rate, the maximum value is 1, the minimum value is 0, and the calculation formula is F1=2*PR / (P+R); wherein P represents the accuracy rate, and the calculation formula is P=TP / (TP+FP), R=TP / (TP+FN) represents the recall rate, TP represents the number of outliers marked as outliers, FP represents the number of normal values ​​marked as outliers, and FN represents the number of outliers marked as normal; the model with the largest F1 score is taken as the mature model, and the maximum value of the anomaly score on the verification set is taken as the threshold of the detection stage in step S6.

9. The method for detecting anomalies of multivariate KPI time series based on multi-angle features according to any one of claims 1 to 4, characterized in that: The step S6 outputs the multivariate KPI time series anomaly detection result, which specifically includes: inputting the multivariate KPI time series to be detected after data preprocessing into a mature detection model, comparing the obtained anomaly score with the threshold, and marking the abnormal point if it exceeds the threshold.

10. A multivariate KPI time series anomaly detection system based on multi-angle features, characterized in that: Operation and maintenance personnel monitor various key performance indicators (KPIs) to determine whether Internet services are stable. By continuously monitoring KPIs, KPI time series data is obtained. When abnormalities are detected in the monitored KPI time series data, it can be concluded that abnormalities have occurred in related applications. The system includes: an embedded graph feature extraction module, a GCN construction module, a time domain feature extraction module, a TCN construction module, a frequency domain feature extraction module, a spectral network construction module, a network fusion and model construction module, a KPI time series storage module, and a detection result output module; wherein, The embedded graph feature extraction module is used to extract embedded graph features based on the structure of M-element KPI time series data, and send the embedded graph features to the GCN construction module; The GCN building module is used to build a graph convolutional neural network GCN for multivariate KPI time series anomaly detection based on embedded graph features, and to characterize the information representation between different variables of the multivariate KPI time series; The time domain feature extraction module is used to obtain the time domain features based on the M-element KPI time series data itself and send them to the TCN construction module; The TCN construction module is used to construct a time domain convolutional neural network TCN for multivariate KPI time series anomaly detection based on time domain features to obtain historical information representation of multivariate KPI time series data in the time domain; The frequency domain feature extraction module is used to determine the real part and the imaginary part of the frequency domain feature of the M-element KPI time series data based on Fourier transform, and send them to the spectrum network construction module; The spectral network construction module is used to construct a spectral network for anomaly detection of multivariate KPI time series data based on frequency domain features to obtain information representation on the multivariate KPI time series period; The network fusion and model building module is used to fuse the feature representations of the GCN, TCN and spectral network outputs of the constructed multivariate KPI time series anomaly detection, and to build a multivariate KPI time series anomaly detection model based on multi-angle features, and to complete the training and verification of the model to obtain a mature multivariate KPI time series anomaly detection model; The KPI time series storage module is used to collect training set and validation set data of the multivariate KPI time series anomaly detection model, and is also used to collect M-element KPI time series to be detected, and store the collected data after preprocessing; The detection result output module is used to output the detection result of the model after inputting the M-element KPI time series to be detected into the mature multi-element KPI time series anomaly detection model.

Images