Anomaly detection model training method and device, equipment and storage medium

Abstract

The application discloses a training method and device of an anomaly detection model, equipment and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the following steps: acquiring a historical time series data set; extracting a plurality of training samples from the historical time series data set; performing mixed sample generation processing on a target time series variable to obtain a processed target time series variable and sample label information; processing a reference time series variable and the processed target time series variable respectively through two detection networks contained in an anomaly detection model to obtain a plurality of vectors corresponding to the reference time series variable and a plurality of vectors corresponding to the processed target time series variable, and determining an anomaly credibility; and adjusting network parameters of the anomaly detection model according to the anomaly credibility and the sample label. The application reduces the calculation complexity of the model and achieves more accurate and more fine-grained anomaly detection effects.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a training method, apparatus, device, and storage medium for an anomaly detection model. Background Technology

[0002] With the development of artificial intelligence technology, models trained by machine learning can be used to detect anomalies in time series data in order to identify abnormal data (or outliers) in the time series data.

[0003] In related technologies, machine learning models are used to reconstruct the original time series data, resulting in reconstructed time series data. The reconstructed time series data is then compared with the original time series data to determine where the error is largest, thereby identifying outliers in the original time series dataset.

[0004] Because the model needs to reconstruct data over long time steps, its computational complexity is high, and it cannot focus on detecting anomalies in data at certain specific locations. Summary of the Invention

[0005] This application provides a training method, apparatus, device, and storage medium for an anomaly detection model.

[0006] According to one aspect of the embodiments of this application, a method for training an anomaly detection model is provided, the method comprising:

[0007] Obtain a historical time series dataset, which includes time series data of n different variables, and the time series data of each variable includes data of multiple time steps, where n is an integer greater than 1;

[0008] Multiple training samples are extracted from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of at least one time step of the n different variables in the first time series, and the target time series variables include data of at least one time step of the n different variables in the second time series. The time domain position of the first time series is located before the time domain position of the second time series.

[0009] The target time series variable is subjected to mixed sample generation processing to obtain the processed target time series variable and sample label information; wherein, the sample label information includes the sample label corresponding to each grid point in the processed target time series variable, each grid point corresponds to the data of a variable in one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample;

[0010] The anomaly detection model uses two detection networks to process the reference time series variable and the processed target time series variable, respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0011] Based on the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the processed target time series variable, the anomaly confidence level corresponding to each grid point in the processed target time series variable is determined.

[0012] Based on the anomaly confidence level and sample label corresponding to each grid point in the processed target time-series variable, the network parameters of the anomaly detection model are adjusted.

[0013] According to one aspect of the embodiments of this application, an anomaly detection method for time-series data is provided, the method comprising:

[0014] Obtain the time series dataset to be detected, which includes time series data of n different variables, and the time series data of each variable includes data of multiple time steps, where n is an integer greater than 1;

[0015] Extract a set of corresponding reference time series variables and target time series variables from the time series dataset to be detected; wherein, the reference time series variables include data of at least one time step of the n different variables contained in the first time series, and the target time series variables include data of at least one time step of the n different variables contained in the second time series, wherein the time domain position of the first time series is located before the time domain position of the second time series;

[0016] The anomaly detection model uses two detection networks to process the reference time series variable and the target time series variable respectively, resulting in multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0017] Based on the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the target time series variable, the anomaly confidence level corresponding to each grid point in the target time series variable is determined.

[0018] According to one aspect of the embodiments of this application, a training apparatus for an anomaly detection model is provided, the apparatus comprising:

[0019] The dataset acquisition module is used to acquire historical time series datasets, which include time series data of n different variables, and the time series data of each variable includes data of multiple time steps, where n is an integer greater than 1;

[0020] The training sample acquisition module is used to extract multiple training samples from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of at least one time step of the n different variables in the first time series, and the target time series variables include data of at least one time step of the n different variables in the second time series. The time domain position of the first time series is located before the time domain position of the second time series.

[0021] A mixed sample acquisition module is used to perform mixed sample generation processing on the target time series variable to obtain the processed target time series variable and sample label information; wherein, the sample label information includes the sample label corresponding to each grid point in the processed target time series variable, each grid point corresponds to the data of a variable in one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample.

[0022] The detection vector acquisition module is used to process the reference time series variable and the processed target time series variable respectively through the two detection networks included in the anomaly detection model to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0023] The anomaly confidence acquisition module is used to determine the anomaly confidence corresponding to each grid point in the processed target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0024] The network parameter adjustment module is used to adjust the network parameters of the anomaly detection model based on the anomaly confidence and sample label corresponding to each grid point in the processed target time series variable.

[0025] According to one aspect of the embodiments of this application, an anomaly detection device for time-series data is provided, the device comprising:

[0026] The dataset acquisition module is used to acquire the time series dataset to be detected. The time series dataset to be detected includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1.

[0027] The detection data extraction module is used to extract a set of corresponding reference time series variables and target time series variables from the time series dataset to be detected; wherein, the reference time series variables include data of at least one time step contained in the first time series of the n different variables, and the target time series variables include data of at least one time step contained in the second time series of the n different variables, and the time domain position of the first time series is located before the time domain position of the second time series;

[0028] The detection vector acquisition module is used to process the reference time series variable and the target time series variable respectively through two detection networks included in the anomaly detection model to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable;

[0029] The anomaly confidence acquisition module is used to determine the anomaly confidence corresponding to each grid point in the target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0030] According to one aspect of the embodiments of this application, a computer device is provided, the computer device including a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the above-described training method for anomaly detection model, or to implement the above-described anomaly detection method for time-series data.

[0031] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, the computer program being loaded and executed by a processor to implement the above-described training method for anomaly detection model, or to implement the above-described anomaly detection method for time-series data.

[0032] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the above-described training method for anomaly detection models, or to implement the above-described anomaly detection method for time-series data.

[0033] The technical solutions provided in this application have at least the following beneficial effects:

[0034] By training an anomaly detection model with two parallel detection network branches, this model can process reference and target time-series variables separately through these two detection networks. Based on the reference time-series variable, it identifies anomalous data within the target time-series variable. Firstly, since only a small portion of the time-series dataset needs to be extracted as reference time-series variables, and then the anomalous data within the corresponding target time-series variable is determined based on this portion, the model does not need to process the entire time-series dataset, reducing computational complexity. Secondly, by flexibly selecting the positions of the reference and target time-series variables, anomaly detection can be targeted at different locations, improving the accuracy of anomaly detection. Furthermore, this model can detect anomalous data in datasets containing multiple different variables, accurately pinpointing which variable and which time step exhibits anomalies and providing corresponding anomaly confidence levels. While achieving simultaneous multi-variable detection, it also considers the correlation between variables, resulting in more accurate and finer-grained anomaly detection. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the implementation environment of a solution provided in one embodiment of this application;

[0036] Figure 2 This is a flowchart of a training method for an anomaly detection model provided in one embodiment of this application;

[0037] Figure 3 This is a schematic diagram of a historical time series dataset provided in one embodiment of this application;

[0038] Figure 4 This is a flowchart of a training method for an anomaly detection model provided in another embodiment of this application;

[0039] Figure 5 This is a schematic diagram illustrating the generation of hybrid samples according to an embodiment of this application;

[0040] Figure 6 This is a schematic diagram of the structure of an iterative autoencoder and a negative sample generator provided in one embodiment of this application;

[0041] Figure 7 This is a schematic diagram of the generated target time-series variable provided in one embodiment of this application;

[0042] Figure 8 This is a schematic diagram of the training process of an anomaly detection model provided in one embodiment of this application;

[0043] Figure 9 This is a schematic diagram of the training process of an anomaly detection model provided in one embodiment of this application;

[0044] Figure 10 This is a schematic diagram of the internal structure of an extension module provided in one embodiment of this application;

[0045] Figure 11 This is a flowchart of an anomaly detection method for time-series data provided in one embodiment of this application;

[0046] Figure 12 This is a schematic diagram illustrating the usage process of an anomaly detection model provided in one embodiment of this application;

[0047] Figure 13 This is a schematic diagram of the anomaly detection result of an anomaly detection model provided in one embodiment of this application;

[0048] Figure 14 This is a schematic diagram of the anomaly detection result of an anomaly detection model provided in another embodiment of this application;

[0049] Figure 15 This is a block diagram of a training apparatus for an anomaly detection model provided in one embodiment of this application;

[0050] Figure 16 This is a block diagram of a training apparatus for an anomaly detection model provided in another embodiment of this application;

[0051] Figure 17 This is a block diagram of an anomaly detection device for time-series data provided in one embodiment of this application;

[0052] Figure 18 This is a block diagram of an anomaly detection device for time-series data provided in another embodiment of this application;

[0053] Figure 19 This is a schematic diagram of the structure of a computer device provided in one embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0055] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce new intelligent machines that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities.

[0056] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0057] Machine learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0058] This application relates to machine learning technology in artificial intelligence, and the technical solution of this application will be described and explained through the following embodiments.

[0059] Please refer to Figure 1 The diagram illustrates an implementation environment provided in one embodiment of this application. This implementation environment can be implemented as a training system for an anomaly detection model. The implementation environment may include a model training device 10 and a model usage device 20.

[0060] The model training device 10 can be an electronic device such as a computer, server, or intelligent robot, or other electronic devices with strong computing power. The model training device 10 trains the anomaly detection model 30 by extracting training samples from historical time-series datasets. In this embodiment, the anomaly detection model 30 is used to detect time-series data and determine abnormal data (or anomalies) contained within the time-series data. The anomaly detection model 30 provided in this embodiment can efficiently detect anomalies in all variables of the time-series dataset to be detected, even if the time-series dataset includes time-series data with multiple different variables.

[0061] like Figure 1As shown, the anomaly detection model 30 includes two detection networks 13, which are referred to as the first detection network 13a and the second detection network 13b for ease of explanation. This embodiment employs a hybrid contrastive learning approach. The training samples include a target temporal variable 11 and a reference temporal variable 12. The anomaly detection model 30 processes the target temporal variable 11 and the reference temporal variable 12 to obtain multiple processed vectors. Anomaly confidence 14 is calculated using these multiple vectors. A training loss 15 is calculated using the target temporal variable 11 and the calculated anomaly confidence 14. The parameters of the anomaly detection model 30 are then adjusted using the training loss 15.

[0062] The anomaly detection model 30 trained as described above can be deployed on the model-using device 20 for anomaly detection on the time-series dataset to be detected. The model-using device 20 can be a terminal device such as a mobile phone, computer, smart TV, multimedia playback device, wearable device, medical device, or a server; this application does not limit this.

[0063] In some embodiments, such as Figure 1 As shown, the anomaly detection model 30 processes the target time series variable 11 and the reference time series variable 12 in the time series dataset to be detected to obtain multiple processed variables. The anomaly confidence 14 is calculated by the multiple variables. The anomaly points in the time series dataset to be detected are obtained by the target time series variable 11 and the calculated anomaly confidence 14.

[0064] The following method embodiments will detail the usage and training process of the anomaly detection model 30.

[0065] Please refer to Figure 2 The diagram illustrates a flowchart of a training method for an anomaly detection model provided in one embodiment of this application. The entity executing this method may be... Figure 1 The model training device 10 in the implementation environment of the scheme shown.

[0066] The method may include at least one of the following steps (110-160):

[0067] Step 110: Obtain the historical time series dataset. The historical time series dataset includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1.

[0068] A historical time series dataset is a collection of time series data containing multiple different variables. Each variable's time series data includes data from multiple time steps. Time series data is data collected at different times and is used to describe how a variable changes over time. The time series data of a particular variable reflects the change in the variable's value over time, including the variable's values ​​at multiple time steps. A time step can be understood as a unit of time, a sampling period, a timestamp, or a sampling moment. For example, a time step can be 0.1 seconds, 1 second, 5 seconds, 1 minute, 3 minutes, 1 hour, 1 day, 1 month, 1 year, etc., which can be set according to actual circumstances, and this application does not impose any limitations on this. Furthermore, since a historical time series dataset includes time series data for multiple different variables, the time steps corresponding to these multiple different variables are the same, for example, all using 1 hour as the time step.

[0069] The number of variables, *n*, determines the data width of a historical time series dataset, while the number of time steps determines its length. A historical time series dataset can be divided into grid points using variables and time steps. Different grid points represent data for different variables at different time steps; each grid point represents the data for one variable at one time step. For example, ... Figure 3 As shown, Figure 3 An exemplary diagram of a historical time series dataset is shown. The data width of the historical time series dataset is determined by the number of variables, such as... Figure 3 In this example, if there are four variables at the same time step, then the data width of the historical time series dataset is four. The data length of a historical time series is determined by the number of time steps. Figure 3 In this example, if there are 23 time steps for the same variable, then the data length of this historical time series dataset is 23. The data corresponding to any time step for any variable is called a grid point, such as... Figure 3 In the historical time series dataset, there are 23*4=92 grid points.

[0070] Variables are the data types contained in a historical time-series dataset. A historical time-series dataset can be composed of a combination of various data types. Optionally, these various data types can be content-related data types. For example, in the scenario of detecting anomalies in medical insurance data, the various variables contained in the historical time-series dataset may include the number of people covered by medical insurance, the age of those covered, the economic level of those covered, and the economic level of the entire population. As another example, in the scenario of detecting anomalies in physical indicators, the various variables contained in the historical time-series dataset may include the patient's heart rate, the patient's pulse rate, the patient's blood pressure, and the patient's respiratory rate. The types of variables contained in the historical time-series dataset will vary depending on the specific scenario. Optionally, the various data types can also be content-independent data types; this application does not impose any limitations on this.

[0071] Step 120: Extract multiple training samples from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of n different variables at at least one time step in the first time series. The target time series variables include data of n different variables at at least one time step in the second time series. The time domain position of the first time series is before the time domain position of the second time series.

[0072] The first time series includes *a* time steps, and the second time series includes *b* time steps, where *a* and *b* are positive integers. Optionally, *a* is greater than or equal to *b*. For example, *a* equals 6 and *b* equals 2. Or, for example, *a* equals 120 and *b* equals 10. The number of time steps in the first and second time series can be reasonably set based on the actual situation, and this application does not impose any limitations on this.

[0073] The first time series consists of all time steps of the reference time series variable, and the second time series consists of all time steps of the target time series variable. Optionally, the first and second time series are continuous in the time domain, and the last time step of the first time series (the latest time step in the time domain) and the first time step of the second time series (the earliest time step in the time domain) are two consecutive time steps in the time domain. Figure 3 As shown, training samples are obtained from the historical time series dataset. The obtained training samples are 8*4 matrices and contain two parts: reference time series variables and target time series variables. The target time series variables are the time series variables for which anomaly detection is to be performed, such as... Figure 3 In the 2x4 matrix, the reference time series variable is a time series variable that assists the target time series variable in anomaly detection, such as... Figure 3The matrix is ​​6x4. The reference time series variable and the target time series variable are continuous in the time domain, and the last time step of the reference time series variable and the first time step of the target time series variable are two consecutive adjacent time steps in the time domain.

[0074] Each training sample includes a corresponding set of reference time-series variables and target time-series variables. For example, by setting a sliding window and sliding it along the time domain on a historical time-series dataset, multiple training samples can be extracted. For instance, the sliding window can include a first sub-window and a second sub-window. The width of the first sub-window covers all n variables, and its length is the number of time steps contained in the first time series. The width of the second sub-window covers all n variables, and its length is the number of time steps contained in the second time series. At each position where the sliding window stops, the data within the first sub-window is extracted as the reference time-series variable, and the data within the second sub-window is extracted as the target time-series variable corresponding to that reference time-series variable. These two elements together constitute a training sample.

[0075] Step 130: Perform mixed sample generation processing on the target time series variable to obtain the processed target time series variable and sample label information; wherein, the sample label information includes the sample label corresponding to each grid point in the processed target time series variable, each grid point corresponds to the data of a variable in one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample.

[0076] The processed target time-series variable is obtained by generating a mixed sample from the target time-series variable. The processed target time-series variable contains both positive and negative samples, which indicate whether the data in the processed target time-series variable is the same as the data at the corresponding grid point in the target time-series variable. Specifically, the data in the positive samples of the processed target time-series variable is the same as the data at the corresponding grid point in the target time-series variable, while the data in the negative samples of the processed target time-series variable is different from the data at the corresponding grid point in the target time-series variable.

[0077] Sample label information is used to indicate whether the data corresponding to each grid point in the processed target time series variable is a positive or negative sample. Positive samples can be represented by 1, and negative samples by -1. Optionally, negative samples can also be represented by any number from 0 to -1; the closer the negative sample value is to -1, the greater the confidence that the data corresponding to that grid point is a negative sample.

[0078] Optionally, paired samples can be obtained through contrastive learning, and positive and negative samples can be identified by comparing elements within each pair. For example, given a batch size of 4 with input data (x1, x2, x3, x4) and (y1, y2, y3, y4), a positive sample within a group is defined as a pair of data (x1, x2, x3, x4) with the same index. i ,y i Negative samples are defined as pairs of data (x, y) with each distinct index. i ,y j Thus, with four input data pairs, we can obtain 4 pairs of positive samples and 12 pairs of negative samples as training data. For example, (x1, y1) is a positive sample and (x1, y2) is a negative sample.

[0079] Step 140: The two detection networks included in the anomaly detection model are used to process the reference time series variable and the processed target time series variable respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0080] Anomaly detection models are AI models used to detect anomalous data in target time series variables. The target time series variable and the reference time series variable are respectively input into two detection networks contained in the model to obtain multiple vectors corresponding to the target time series variable and multiple vectors corresponding to the reference time series variable. The number of multiple vectors output by each detection network is the same as the number of grid points of the target time series variable.

[0081] In addition, the detection networks corresponding to the reference time-series variable and the target time-series variable have the same structure, but because the data of the reference time-series variable and the target time-series variable are different, the parameters of the generated detection networks corresponding to the reference time-series variable and the target time-series variable will be different during the model training process.

[0082] Step 150: Based on the multiple vectors corresponding to the reference time series variables and the multiple vectors corresponding to the processed target time series variables, determine the anomaly confidence level corresponding to each grid point in the processed target time series variables.

[0083] For multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable, the anomaly confidence level of the grid point can be calculated based on the two vectors corresponding to the same grid point in these two variables. The anomaly confidence level characterizes the probability that the grid point is anomalous data. For example, the anomaly confidence level can be a value ranging from [-1, 1]. The closer the anomaly confidence level of a grid point is to -1, the greater the probability that the data at that grid point is anomalous; the closer the anomaly confidence level of a grid point is to 1, the smaller the probability that the data at that grid point is anomalous.

[0084] Step 160: Adjust the network parameters of the anomaly detection model based on the anomaly confidence and sample label corresponding to each grid point in the processed target time series variable.

[0085] Based on the processed sample labels and anomaly confidence levels of the target time-series variables, the training loss of the aforementioned anomaly detection model is obtained. This training loss is then used to adjust the network parameters of the anomaly detection model. Specifically, the training loss is calculated based on the anomaly confidence level and sample label corresponding to each training sample using the loss function corresponding to the model. This training loss measures the detection error of the anomaly detection model. By continuously adjusting the network parameters of the anomaly detection model with the goal of minimizing this training loss, a more accurate anomaly detection model can ultimately be obtained.

[0086] The technical solution provided in this application, through training an anomaly detection model containing two parallel detection network branches, allows the model to process reference and target time-series variables separately using these two detection networks. Based on the reference time-series variable, it determines the anomalous data contained in the target time-series variable. On one hand, since only a small portion of time steps needs to be extracted from the time-series dataset as reference time-series variables, and then the anomalous data contained in the corresponding target time-series variable is determined based on this portion of the reference time-series variable, the model does not need to process the entire time-series dataset, reducing computational complexity. On the other hand, by flexibly selecting the positions of the reference and target time-series variables, anomaly detection can be performed on data at different positions in a targeted manner, improving the accuracy of anomaly detection. Moreover, this model can detect anomalous data in datasets containing multiple different variables, and can accurately locate which variable's data at which time step is abnormal, providing corresponding anomaly confidence. While achieving simultaneous multi-variable detection, it also considers the correlation between variables, achieving a more accurate and fine-grained anomaly detection effect.

[0087] Please refer to Figure 4 The diagram illustrates a flowchart of a training method for an anomaly detection model provided in another embodiment of this application. The entity executing this method may be... Figure 1 The illustrated scheme is implemented in an environment with a model training device 10. The method may include at least one of the following steps (210-290):

[0088] Step 210: Obtain the historical time series dataset. The historical time series dataset includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1.

[0089] Step 220: Extract multiple training samples from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of n different variables at at least one time step in the first time series. The target time series variables include data of n different variables at at least one time step in the second time series. The time domain position of the first time series is before the time domain position of the second time series.

[0090] Subsequently, the target time series variable is subjected to mixed sample generation processing to obtain the processed target time series variable and sample label information. The sample label information includes the sample label corresponding to each grid point in the processed target time series variable. Each grid point corresponds to the data of a variable at one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample.

[0091] Optionally, the processed target time series variable is a mixed time series variable. The data at each grid point in the mixed time series variable can be either positive or negative samples. The mixed time series variable must include at least one positive sample and at least one negative sample. In some embodiments, such as... Figure 5 As shown, Figure 5 The example illustrates the process of generating mixed time series variables. First, four target time series variables (0, 1, 2, and 3) are obtained from the same batch, where 0, 1, 2, and 3 are all positive samples. After passing through a mixed sample generator, four mixed time series variables are obtained: 0, 1, 2, and 3. Each mixed time series variable contains four positive sample grid points and four negative sample grid points, with the negative sample modification ratio being 50%.

[0092] In some embodiments, the processed target time-series variables and sample label information are obtained through a hybrid sample generator, which includes an iterative autoencoder and a negative sample generator. The process of generating the processed target time-series variables described above may include the following steps 230-250.

[0093] Step 230: The target time series variable is processed by an iterative autoencoder to shrink each data point in the target time series variable toward the global mean, thus obtaining the reconstructed target time series variable.

[0094] An iterative autoencoder (AUE) processes a target time-series variable through multiple iterations to obtain a reconstructed target time-series variable. The target time-series variable is first input into the AUE to obtain the target time-series variable after the first iteration. This process is repeated to obtain the target time-series variable after the Nth iteration, where N is an integer greater than 1. Once the number of iterations reaches a set threshold, the reconstructed target time-series variable is obtained, and the data points in the reconstructed target time-series variable shrink towards the global mean. For example, if the target time-series variable contains the data points 1, 1, 1, 2, 1, 3, 1, 100, the iterative autoencoder shrinks the deviation of 100, resulting in the reconstructed target time-series variable containing the data points 1, 1, 1, 2, 1, 3, 1, 10.

[0095] During the iteration process, iterative calculations can be performed by setting a weight value *r*. The variance of the target temporal vector of the current batch of input iterative autoencoders is multiplied by *r*. The historical cumulative variance values ​​of all input iterative autoencoders before this batch are multiplied by 1-*r*. The variances obtained from these two multiplications are then averaged. This average value is set as the new variance value, and this new variance value is stored as the cumulative variance value for the next iteration. In the first iteration, the historical cumulative variance value does not need to be considered.

[0096] Step 240: The reconstructed target time series variable is processed by the negative sample generator to obtain the negative sample time series variable; wherein, the data of each grid point in the negative sample time series variable is a negative sample.

[0097] The negative sample generator is used to generate negative sample time series variables. The size of the generated negative sample time series variable (i.e., the number of grid points it contains) is the same as the size of the reconstructed target time series variable. The negative sample time series variable can be understood as randomly modifying the data of each grid point in the reconstructed target time series variable and setting it as a negative sample.

[0098] Optionally, step 240 includes the following steps A to B:

[0099] A: Multiple random number generation algorithms are used to generate multiple random number matrices with the same number of grid points as the reconstructed target time series variables.

[0100] Random number generation algorithms are used to randomly generate data. Based on the magnitude of the reconstructed target time-series variable, the algorithm generates a random number matrix with the same magnitude as the reconstructed target time-series variable. Random number generation algorithms include, but are not limited to, at least one of the following algorithms: Gamma, Beta, Normal, Laplace, Cauchy, etc.

[0101] Optionally, step A includes the following steps A1 to A3:

[0102] A1: Generate a weight matrix based on the intermediate vector obtained during the processing of the target time series variable by the iterative autoencoder. The weight matrix includes the weight values ​​corresponding to multiple random number matrices.

[0103] The weight matrix is ​​the weight matrix corresponding to the random number matrix. Optionally, during the processing of the target time series variable, since the random number generation algorithm is preset, a corresponding weight value is set for each random number generation algorithm based on the differences between the target time series variable and each random number generation algorithm. The weight value is the weight of the random number matrix, which is obtained by processing the intermediate vector in the iterative encoder. Different weight values ​​determine the proportion of each random number matrix in the generated negative sample time series variable.

[0104] A2: Generate a random discard matrix, which includes discard values ​​corresponding to multiple random number matrices. The discard values ​​are used to indicate whether to discard the corresponding random number matrix.

[0105] The random discard matrix is ​​randomly generated and is used to indicate whether multiple random number matrices have been discarded. For example, if a random number matrix in the random discard matrix has a discard value of 1, it means that the random number matrix is ​​not discarded; conversely, if a random number matrix in the random discard matrix has a discard value of 0, it means that the random number matrix has been discarded. "Discarded" means that it is not actually used in the calculation.

[0106] In some embodiments, the following four random number generation algorithms are used: Gamma, Beta, Normal, and Laplace. In this case, the random discard matrix contains discard values ​​of 0, 1, 1, and 0. The random number matrices generated by the Gamma and Laplace algorithms are discarded, while the random number matrices generated by the Beta and Normal algorithms are retained. In this case, the negative sample time series variables are generated only by Beta and Normal random numbers.

[0107] A3: Multiply multiple random number matrices by their corresponding weights and discard values, and then sum them to obtain the negative sample time series variables.

[0108] After filtering by the random discard matrix, the random number matrix required to generate negative sample time series variables is determined. The random number matrix and the corresponding weight values ​​are multiplied and then added together to obtain the negative sample time series variables.

[0109] By adding a random dropout matrix, we can obtain more diverse negative sample time series variables flexibly and efficiently.

[0110] In some embodiments, such as Figure 6 As shown, Figure 6 An example diagram of the structure of an iterative autoencoder and a negative sample generator is shown. Figure 6 In the iterative autoencoder part, the target time series variable is input into the iterative autoencoder for reconstruction. The output obtained from the reconstruction is used as the input of the iterative autoencoder to output a new reconstruction result. After multiple iterations of reconstruction, the iterative autoencoder outputs the reconstructed target time series variable.

[0111] Figure 6 In the negative sample generator section, multiple random number matrices of the same size as the target time-series variable are first generated using multiple random number generators. These random number matrices are then standardized, multiplied by their corresponding weight matrices, and finally multiplied by the random discard matrix to obtain the processed target time-series variable. The weight values ​​corresponding to the random number matrices are intermediate vectors generated during the reorganization of the target time-series variable by the iterative autoencoder, and obtained through encoding. These weight values ​​allow for flexible adjustment of the proportion of each random number matrix during the generation of the negative sample time-series variable. Figure 6 W0 to W5 in the equation are the weight values ​​obtained after encoding the intermediate vectors generated in the iterative autoencoder.

[0112] B: Perform a weighted summation on multiple random number matrices to obtain a summation matrix. Add the summation matrix to the reconstructed target time series variable to obtain the negative sample time series variable.

[0113] By multiplying multiple random number matrices with their corresponding weights and then summing them, we obtain random number noise (i.e., a summation matrix). The obtained random number noise is then added to the reconstructed target time series variable, and the result is the negative sample time series variable.

[0114] By obtaining negative sample time series variables through multiple random number matrices and their corresponding weights, the resulting negative sample time series variables can have more different forms. By training the model with various different negative sample time series variables, the trained anomaly detection model can be more complete and can detect anomalous data of various forms.

[0115] Step 250: Integrate the target time series variable and the negative sample time series variable to obtain the processed target time series variable and sample label information.

[0116] The reconstructed target time-series variable and the negative sample time-series variable are integrated in a certain way to obtain the processed target time-series variable and the corresponding sample label information. The processed target time-series variable yields different results depending on the integration method. Optionally, the processed target time-series variable can be either the reconstructed target time-series variable or the negative sample time-series variable. However, in most cases, the processed target time-series variable is formed by integrating the reconstructed target time-series variable and the negative sample time-series variable. That is, the data at a grid point in the processed target time-series variable can be the data at the corresponding grid point in either the reconstructed target time-series variable or the negative sample time-series variable. Therefore, the processed target time-series variable is generated by integrating the reconstructed target time-series variable and the negative sample time-series variable.

[0117] Optionally, step 250 includes the following steps C to E:

[0118] C: Select some grid points from the target time series variable and some grid points from the negative sample time series variable to construct the processed target time series variable.

[0119] The data at a grid point in the processed target time series variable can be the data at the corresponding grid point in the reconstructed target time series variable or the data at the corresponding grid point in the negative sample time series variable. For example, if the data at each grid point in the reconstructed target time series variable are 1, 2, 3, 4, and the data at each grid point in the negative sample time series variable are 5, 6, 7, 8, then the processed target time series variable can be 1, 2, 7, 8, or it can be 1, 6, 3, 4. This application does not limit the composition of the processed target time series variable.

[0120] Optionally, a mask matrix is ​​randomly generated to determine the composition of the data at each grid point in the processed target time series variable. For example, the data at each grid point in the reconstructed target time series variable are 1, 2, 3, 4; the data at each grid point in the negative sample time series variable are 5, 6, 7, 8. The values ​​of the mask matrix are 0, 1, 1, 0. Here, the first 0 indicates that the data at the first grid point in the processed target time series variable is the data at the first grid point in the negative sample time series variable, and the first 1 indicates that the data at the second grid point in the processed target time series variable is the data at the second grid point in the reconstructed target time series variable. And so on, resulting in the data for the processed target time series variable as: 5, 2, 3, 8.

[0121] In some embodiments, such as Figure 7 As shown, Figure 7An exemplary diagram of the generated structure of the processed target time-series variable is shown. As shown in the figure, the mask matrix values ​​corresponding to the negative sample time-series variable and the target time-series variable are 0, 1, 1, 1, 1, 0, 0, 1. Based on the values ​​of the mask matrix, the corresponding processed target time-series variable and its sample label information are generated. Specifically, the data at the grid points corresponding to a mask matrix value of 0 represents the data at the corresponding grid points in the negative sample time-series variable, and the label information is denoted as negative sample; the data at the grid points corresponding to a mask matrix value of 1 represents the data at the corresponding grid points in the target time-series variable, and the label information is denoted as positive sample.

[0122] D: Determine the data from the target time series variable in the processed target time series variable as positive samples; and determine the data from the negative sample time series variable in the processed target time series variable as negative samples.

[0123] Since the data in the reconstructed target time series variable is from the original target time series variable, this data is a positive sample; since the data in the negative sample time series variable is randomly generated rather than from the original target time series variable, this data is a negative sample.

[0124] E: Based on the determination results of positive and negative samples, obtain the sample label information.

[0125] Based on the positive and negative samples obtained above, sample label information is obtained, which represents the positive and negative sample values ​​of each grid point in the target time series variable after the above processing.

[0126] By integrating the target time series variable and the negative sample time series variable, the processed target time series variable is obtained. By training the model with various processed target time series variables, the trained anomaly detection model can be made more perfect and better able to adapt to various anomaly data.

[0127] In some embodiments, the method provided in this application further includes the following steps: superimposing a location embedding matrix on a reference time-series variable and a processed target time-series variable to obtain a superimposed reference time-series variable and a superimposed target time-series variable; wherein, the superimposed reference time-series variable and the superimposed target time-series variable serve as inputs to two detection networks, the location embedding matrix contains location embedding vectors corresponding to each grid point, any two grid points at the same time step have the same location embedding vector, any two grid points at different time steps have different location embedding vectors, and the location embedding vectors are dynamically learned and updated during model training.

[0128] The location embedding matrix is ​​used to maintain the temporal information of the reference temporal variable and the processed target temporal variable. The size of the location embedding matrix corresponding to the reference temporal variable is the same as the size of the reference temporal variable itself, and the size of the location embedding matrix corresponding to the processed target temporal variable is the same as the size of the processed target temporal variable. The location embedding vectors of each grid point in the reference and processed target temporal variables are superimposed using the location embedding matrix. The superimposed reference and target temporal variables are then used as inputs to two detection networks. For example, if the reference temporal variable is a 6x4 matrix, then the corresponding location embedding matrix is ​​also a 6x4 matrix; if the processed target temporal variable is a 2x4 matrix, then the corresponding location embedding matrix is ​​also a 2x4 matrix.

[0129] Step 260: The two detection networks included in the anomaly detection model are used to process the reference time series variable and the processed target time series variable respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0130] Then, based on the multiple vectors corresponding to the reference time series variables and the multiple vectors corresponding to the processed target time series variables, the anomaly confidence level corresponding to each grid point in the processed target time series variables is determined.

[0131] In some embodiments, the calculation of the above-mentioned anomaly confidence level includes the following steps 270-280:

[0132] Step 270: For multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable, calculate the similarity between two vectors corresponding to the same grid point.

[0133] The similarity between the vectors corresponding to the reference time series variable and the vectors corresponding to the processed target time series variable can be calculated using the grid points in the target time series variable. Similarity refers to the degree of closeness between the vectors corresponding to the reference and target time series variables. For example, when the similarity value ranges from -1 to 1, a greater degree of closeness results in a similarity closer to 1, and a smaller degree of closeness results in a similarity closer to -1. For instance, the similarity between the two vectors can be obtained by calculating the cosine similarity. Similarly, the similarity can be obtained by calculating the Pearson correlation coefficient between the two vectors.

[0134] Step 280: Determine the anomaly confidence level of each grid point in the processed target time series variable based on the similarity level of each grid point.

[0135] Anomaly confidence is used to represent the sample confidence of each grid point in the processed target time series variable. The similarity values ​​obtained from the cosine similarity and Pearson correlation coefficient are both between -1 and 1. Therefore, for example, a similarity of 1 indicates a 100% confidence that the grid point in the processed target time series variable is a positive sample; a similarity of -1 indicates a 100% confidence that the grid point in the processed target time series variable is a negative sample; and a similarity of -0.5 indicates a 50% confidence that the grid point in the processed target time series variable is a negative sample.

[0136] In some embodiments, when the similarity values ​​corresponding to each grid point in the processed target time-series variable are not between -1 and 1, the obtained similarity values ​​are normalized so that the normalized similarity values ​​are between -1 and 1. Then, the anomaly confidence level corresponding to each grid point in the processed target time-series variable is determined.

[0137] In some embodiments, such as Figure 8 As shown, Figure 8 In the similarity calculation region, the anomaly confidence level of each grid point in the processed target time series variable is determined by calculating the similarity between multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable. The anomaly confidence level of a grid point is calculated from the similarity between its two corresponding vectors. This anomaly confidence level can be 1 (positive sample) or -1 to 0 (negative sample).

[0138] By calculating similarity, the anomaly confidence level is determined, yielding the difference between the anomaly confidence level of each grid point of the processed target time-series variable and the corresponding sample label information. This difference is then used to obtain the training loss for the anomaly detection model, which is then used to train the model.

[0139] Step 290: Adjust the network parameters of the anomaly detection model based on the anomaly confidence and sample label corresponding to each grid point in the processed target time series variable.

[0140] Optionally, adjusting the network parameters of the anomaly detection model may also include adjusting the location embedding matrix.

[0141] In some embodiments, the detection network includes a feature extraction network and a discriminative clustering network. The step of obtaining multiple vectors corresponding to the reference time-series variable and the processed target time-series variable through the detection network includes the following steps (F~G):

[0142] F: By using the feature extraction networks contained in the two detection networks, features are extracted from the reference time-series variable and the processed target time-series variable, respectively, to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the processed target time-series variable.

[0143] Feature extraction involves extracting feature information from data in reference and target time series variables, resulting in feature information corresponding to the reference and target time series variables after processing. This feature information is used to provide high-dimensional representations of the data at each time step for different variables in both the reference and target time series variables.

[0144] Optionally, the feature extraction network includes m cascaded extension modules, each extension module including an extended encoder and a fully connected feature layer, where m is an integer greater than 1. Step F further includes the following steps (F1~F4):

[0145] F1: Input the reference time series variable and the processed target time series variable into the first extension module of the two feature extraction networks respectively.

[0146] F2: The extended encoder of the extended module extracts the correlation between different time steps and the correlation between different variables from its own input data, and obtains the extracted features as the input data of the feature fully connected layer of the extended module.

[0147] F3: The feature fully connected layer of the extension module performs dimensionality increase and decrease on its own input data, and the processed features are used as the input data of the extension encoder of the next extension module.

[0148] F4: Obtain the output data of the fully connected feature layer of the last extension module in the two feature extraction networks respectively, and obtain the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable.

[0149] In some embodiments, such as Figure 8 As shown, Figure 8 A schematic diagram of the anomaly detection model training process is shown. Figure 8The reference time-series variable has three extension modules. After the reference time-series variable is superimposed with position embedding vectors, a superimposed reference time-series variable is obtained. This superimposed reference time-series variable is input into the first extension module, where the extended encoder extracts features from it. The extracted features are then input into the feature fully connected layer to obtain the extended reference time-series variable, which is extended along the time-step dimension. The second and third extension modules perform secondary and tertiary extensions on the superimposed reference time-series variable, respectively, resulting in a tertiary extended reference time-series variable. Data transformation is then performed on this tertiary extended reference time-series variable to obtain its corresponding feature information. Similarly, the processed target time-series variable is superimposed with position embedding vectors. The three extension modules sequentially perform primary, secondary, and tertiary extensions on this target time-series variable, resulting in a tertiary extended target time-series variable. Data transformation is then performed on this tertiary extended target time-series variable to obtain its corresponding feature information. For example, when the expansion module is a 4x expansion module, after expansion through three expansion modules, the time step dimension of the processed target time series variable is 64 times that of the original target time series variable. The data transformation described above converts a matrix into a vector by stretching the matrix. Optionally, the number of expansion modules can be four or more; this application does not impose any limitation on this.

[0150] Optionally, if the dimensionality of the processed target time-series variable is too large, it can be reduced in dimensionality before proceeding with subsequent operations. For example, reducing the dimensionality to 1024 dimensions can, to some extent, solve the problem of too many parameters making training impossible.

[0151] In addition, by expanding and increasing the dimensionality of the time-series variables, more feature information about the time-series variables can be obtained, resulting in more accurate anomaly detection results and shortening the training time required for the anomaly detection model.

[0152] G: Through the discriminant cluster networks contained in the two detection networks, the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable are discriminated, respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0153] The discriminative cluster network is used to discriminate between the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable, so as to obtain multiple vectors at corresponding positions in the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable. The number of these multiple vectors is the same as the number of grid points in the target time series variable, and there is a one-to-one correspondence between these multiple vectors and the data of each grid point in the target time series variable.

[0154] Optionally, the discriminant cluster network comprises p sub-networks, where p is the number of grid points contained in the target time-series variable, and p is an integer greater than 1. Step G includes the following steps (G1~G2):

[0155] G1: Input the feature information corresponding to the reference time series variable into the p sub-networks contained in the first discriminant cluster network, and perform discrimination processing by the p sub-networks contained in the first discriminant cluster network to output the p vectors corresponding to the reference time series variable; wherein, the first discriminant cluster network is the discriminant cluster network contained in the detection network used to process the reference time series variable among the two detection networks.

[0156] G2: Input the feature information corresponding to the processed target time series variable into the p sub-networks contained in the second discriminant cluster network. The p sub-networks contained in the second discriminant cluster network perform discrimination processing and output the p vectors corresponding to the processed target time series variable. The second discriminant cluster network is the discriminant cluster network contained in the detection network used to process the processed target time series variable among the two detection networks.

[0157] The discriminative cluster network includes a first discriminative cluster network and a second discriminative cluster network. Each of the first and second discriminative cluster networks contains p subnetworks, where p is the number of grid points in the target time-series variable. The vectors generated by each subnetwork correspond one-to-one with the data of each grid point in the target time-series variable. For example, if the target time-series variable contains 4 grid points, then the first and second discriminative cluster networks each contain 4 subnetworks. The first discriminative cluster network uses these 4 subnetworks to discriminate the feature information corresponding to the reference time-series variables, obtaining vectors corresponding to the 4 reference time-series variables. The second discriminative cluster network uses these 4 subnetworks to discriminate the feature information corresponding to the processed target time-series variables, obtaining vectors corresponding to the 4 processed target time-series variables.

[0158] In some embodiments, such as Figure 9 As shown, Figure 9An exemplary flowchart of the training method for an anomaly detection model is shown. Training samples are obtained from a historical time dataset and divided into target time-series variables and reference time-series variables. The target time-series variables are processed into mixed samples to obtain processed target time-series variables. The reference time-series variables and the processed target time-series variables are then processed by a detection network. Anomaly confidence is obtained through similarity assessment. The training loss is used to adjust the parameters of the anomaly detection model based on the difference between the anomaly confidence and the sample labels. The anomaly detection model is trained repeatedly to obtain the completed anomaly detection model.

[0159] This embodiment integrates the target time series variable and the negative sample time series variable to obtain the processed target time series variable. By training the model with various processed target time series variables, the trained anomaly detection model can be made more complete, better able to detect various anomaly data, and its robustness and detection capability can be improved.

[0160] Furthermore, by calculating similarity, anomaly confidence is determined, yielding the difference between the anomaly confidence of each grid point of the processed target time-series variable and the corresponding sample label information. This is used to obtain the training loss of the anomaly detection model for training.

[0161] In addition, by expanding and increasing the dimensionality of the time-series variables, more feature information about the time-series variables can be obtained, resulting in more accurate anomaly detection results and shortening the training time required for the anomaly detection model.

[0162] In some embodiments, such as Figure 10 As shown, Figure 10 An exemplary schematic diagram of the internal structure of the extension module is shown. Figure 10 The diagram shown is of a 4x expanded expansion module. Figure 10 The temporal vector is expanded using four encoders. The initial temporal variables are input into the first encoder to obtain the first output matrix, which includes the reference temporal variables and the processed target temporal variables. The first output matrix is ​​then added to the initial temporal variables and input into the second encoder to obtain the second output matrix. The second output matrix is ​​then added to the initial temporal variables and input into the third encoder to obtain the third output matrix. The third output matrix is ​​then added to the initial temporal variables and input into the fourth encoder to obtain the fourth output matrix. Finally, the first, second, third, and fourth output matrices are horizontally stacked through a fully connected feature layer to obtain the expanded temporal variables.

[0163] Optionally, after obtaining the expanded time-series variables, the dimensions of these expanded time-series variables can be increased to obtain dimensionality-upgraded time-series variables. Compared to the original time-series variables, the dimensionality-upgraded time-series variables can obtain more high-dimensional representation information. After obtaining the high-dimensional representation information, the dimensionality of the dimensionality-upgraded time-series variables can be reduced to their original dimensions.

[0164] Please refer to Figure 11 The diagram illustrates a flowchart of an anomaly detection method for time-series data provided in one embodiment of this application. The execution entity of this method may be... Figure 1 The model in the implementation environment of the illustrated scheme uses device 20. The method may include at least one of the following steps (310-340):

[0165] Step 310: Obtain the time series dataset to be detected. The time series dataset to be detected includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1.

[0166] Step 320: Extract a set of corresponding reference time series variables and target time series variables from the time series dataset to be detected; wherein, the reference time series variables include data of n different variables at at least one time step contained in the first time series, and the target time series variables include data of n different variables at at least one time step contained in the second time series, and the time domain position of the first time series is located before the time domain position of the second time series.

[0167] Step 330: The reference time series variable and the target time series variable are processed by the two detection networks contained in the anomaly detection model to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0168] Optionally, the detection network includes a feature extraction network and a discriminative clustering network, and step 330 includes the following steps (1-2):

[0169] 1: By using the feature extraction networks contained in the two detection networks, features are extracted from the reference time series variable and the target time series variable respectively, so as to obtain the feature information corresponding to the reference time series variable and the feature information corresponding to the target time series variable.

[0170] Optionally, the feature extraction network includes m cascaded extension modules, each extension module including an extended encoder and a fully connected feature layer, where m is an integer greater than 1. Step 1 includes:

[0171] The reference time series variable and the target time series variable are respectively input into the first extension module of the two feature extraction networks;

[0172] The extended encoder of the extended module extracts the correlation between different time steps and the correlation between different variables from its own input data, and obtains the extracted features as the input data of the feature fully connected layer of the extended module.

[0173] The feature fully connected layer of the extension module performs dimensionality upscaling and dimensionality reduction on its own input data, and the processed features are used as the input data of the extension encoder of the next extension module.

[0174] The output data of the fully connected feature layer of the last extension module in each of the two feature extraction networks are obtained to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the target time-series variable.

[0175] 2: By using the discriminant cluster networks contained in the two detection networks, the feature information corresponding to the reference time series variable and the feature information corresponding to the target time series variable are discriminated, respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0176] Optionally, the cluster network is determined to include p sub-networks, where p is the number of grid points contained in the target time-series variable, and p is an integer greater than 1. Step 2 includes:

[0177] The feature information corresponding to the reference time series variable is input into the p sub-networks contained in the first discriminant cluster network, and the p sub-networks contained in the first discriminant cluster network perform discrimination processing and output the p vectors corresponding to the reference time series variable; wherein, the first discriminant cluster network is the discriminant cluster network contained in the detection network used to process the reference time series variable among the two detection networks;

[0178] The feature information corresponding to the target time series variable is input into the p sub-networks contained in the second discriminant cluster network. The p sub-networks contained in the second discriminant cluster network perform discrimination processing and output the p vectors corresponding to the target time series variable. The second discriminant cluster network is the discriminant cluster network contained in the detection network used to process the target time series variable among the two detection networks.

[0179] Step 340: Based on the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the target time series variable, determine the anomaly confidence level corresponding to each grid point in the target time series variable.

[0180] Optionally, step 340 includes:

[0181] For multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable, calculate the similarity between two vectors corresponding to the same grid point;

[0182] Based on the similarity of each grid point in the target time series variable, the anomaly confidence level of each grid point in the target time series variable is determined.

[0183] The steps in the implementation of this model on the training side have been described in the above implementation of the training side, and will not be repeated here.

[0184] Optionally, when processing time-series data with significant fluctuations, the time-series data can be reconstructed to become stable before implementing anomaly detection. This effectively balances the issues of data unreliability and abnormal fluctuations inherent in time-series data.

[0185] In some embodiments, such as Figure 12 As shown, Figure 12 The flowchart illustrating the usage of the anomaly detection model is provided. Time-series data is obtained from a historical time dataset and divided into target time-series variables and reference time-series variables. After processing the reference and target time-series variables through a detection network, anomaly confidence is obtained through similarity assessment. The anomaly confidence is then used to determine whether an anomaly exists in the target time-series variable.

[0186] The technical solution provided in this application, through training an anomaly detection model containing two parallel detection network branches, allows the model to process reference and target time-series variables separately using these two detection networks. Based on the reference time-series variable, it determines the anomalous data contained in the target time-series variable. On one hand, since only a small portion of time steps needs to be extracted from the time-series dataset as reference time-series variables, and then the anomalous data contained in the corresponding target time-series variable is determined based on this portion of the reference time-series variable, the model does not need to process the entire time-series dataset, reducing computational complexity. On the other hand, by flexibly selecting the positions of the reference and target time-series variables, anomaly detection can be performed on data at different positions in a targeted manner, improving the accuracy of anomaly detection. Moreover, this model can detect anomalous data in datasets containing multiple different variables, and can accurately locate which variable's data at which time step is abnormal, providing corresponding anomaly confidence. While achieving simultaneous multi-variable detection, it also considers the correlation between variables, achieving a more accurate and fine-grained anomaly detection effect.

[0187] In some embodiments, such as Figure 13 As shown, Figure 13 An example is shown in the diagram illustrating the anomaly detection results of the anomaly detection model. Figure 13 Part (a) shows the training curves for positive samples, where the light-colored portion is the training curve for the original positive samples; the dark-colored portion is the training curve for the compressed and integrated positive samples. Similarly, Figure 13Part (b) shows the training curves for negative samples, where the light-colored part is the training curve for the original negative samples, and the dark-colored part is the training curve for the compressed and integrated negative samples. Figure 13 The horizontal axis of parts (a) and (b) represents the length of the time series dataset, that is, the length of the time step of the time series dataset. Figure 13 Part (c) shows the loss of the iterative autoencoder during training. Figure 13 Section (d) illustrates the dynamic adjustment of learning power during training, specifically the dynamic adjustment of the detection network and the location embedding vector. Figure 13 In section (c), the horizontal axis represents the length of the time series dataset, and the vertical axis represents the loss value of the iterative autoencoder. Figure 13 In section (d), the horizontal axis represents the length of the time series dataset, and the vertical axis represents the learning capacity.

[0188] In some embodiments, such as Figure 14 As shown, Figure 14 Examples of anomaly detection results from other anomaly detection models are shown below. Figure 14 Part (a) shows a schematic diagram of the positive and negative sample results of real-time data. Figure 14 Part (b) shows a schematic diagram of the anomaly analysis results obtained through the anomaly detection model. Figure 14 Section (c) shows a schematic diagram of the final result obtained after processing the anomaly analysis results. Among them, Figure 14 In the three graphs (a), (b), and (c), the horizontal axis represents the length of the time series dataset, and the vertical axis represents the number of data types in the time series dataset, that is, the number of variables. Figure 14 The display shows white and black areas, with white areas representing positive sample data and black areas representing negative sample data.

[0189] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0190] Please refer to Figure 15This diagram illustrates a block diagram of a training apparatus for an anomaly detection model according to an embodiment of this application. The apparatus has the function of implementing the training method for the aforementioned anomaly detection model. This function can be implemented in hardware or by hardware executing corresponding software. The apparatus 1500 can be the model training device described above, or it can be located within a model training device. The apparatus 1500 may include: a dataset acquisition module 1510, a training sample acquisition module 1520, a mixed sample acquisition module 1530, a detection vector acquisition module 1540, an anomaly confidence acquisition module 1550, and a network parameter adjustment module 1560.

[0191] The dataset acquisition module 1510 is used to acquire a historical time series dataset, which includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1.

[0192] The training sample acquisition module 1520 is used to extract multiple training samples from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of at least one time step of the n different variables in the first time series, and the target time series variables include data of at least one time step of the n different variables in the second time series. The time domain position of the first time series is located before the time domain position of the second time series.

[0193] The mixed sample acquisition module 1530 is used to perform mixed sample generation processing on the target time series variable to obtain the processed target time series variable and sample label information; wherein, the sample label information includes the sample label corresponding to each grid point in the processed target time series variable, each grid point corresponds to the data of a variable in one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample.

[0194] The detection vector acquisition module 1540 is used to process the reference time-series variable and the processed target time-series variable respectively through the two detection networks included in the anomaly detection model, to obtain multiple vectors corresponding to the reference time-series variable and multiple vectors corresponding to the processed target time-series variable.

[0195] The anomaly confidence acquisition module 1550 is used to determine the anomaly confidence corresponding to each grid point in the processed target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0196] The network parameter adjustment module 1560 is used to adjust the network parameters of the anomaly detection model according to the anomaly confidence and sample label corresponding to each grid point in the processed target time series variable.

[0197] In some embodiments, the processed target time-series variable and the sample label information are obtained through a hybrid sample generator, which includes an iterative autoencoder and a negative sample generator; as shown in the following examples. Figure 16 As shown, the mixed sample acquisition module 1530 includes: a time series variable reconstruction unit 1531, a negative sample acquisition unit 1532, and a time series variable integration unit 1533.

[0198] The time series variable reconstruction unit 1531 is used to process the target time series variable through the iterative autoencoder, so that each data in the target time series variable shrinks to the global mean, and obtains the reconstructed target time series variable.

[0199] The negative sample acquisition unit 1532 is used to process the reconstructed target time series variable through the negative sample generator to obtain negative sample time series variables; wherein, the data of each grid point in the negative sample time series variables are negative samples.

[0200] The time series variable integration unit 1533 is used to integrate the target time series variable and the negative sample time series variable to obtain the processed target time series variable and the sample label information.

[0201] In some embodiments, the negative sample acquisition module 1532 is used for:

[0202] Multiple random number generation algorithms are used to generate multiple random number matrices with the same number of grid points as the reconstructed target time series variable;

[0203] The multiple random number matrices are weighted and summed, and then added to the reconstructed target time series variable to obtain the negative sample time series variable.

[0204] In some embodiments, the negative sample acquisition module 1532 is used for:

[0205] A weight matrix is ​​generated based on the intermediate vector obtained during the processing of the target time-series variable by the iterative autoencoder. The weight matrix includes the weight values ​​corresponding to the plurality of random number matrices.

[0206] Generate a random discard matrix, which includes discard values ​​corresponding to the plurality of random number matrices, and the discard values ​​are used to indicate whether to discard the random number matrices;

[0207] The negative sample time series variable is obtained by multiplying the multiple random number matrices by their corresponding weight values ​​and discard values, and then summing the results.

[0208] In some embodiments, the timing variable integration unit 1533 is used for:

[0209] The processed target time series variable is constructed by selecting a portion of grid data from the target time series variable and a portion of grid data from the negative sample time series variable.

[0210] Data from the target time series variable in the processed target time series variable are identified as positive samples; and data from the negative sample time series variable in the processed target time series variable are identified as negative samples.

[0211] Based on the determination results of the positive and negative samples, the sample label information is obtained.

[0212] In some embodiments, the detection network includes a feature extraction network and a discriminative cluster network; such as Figure 16 As shown, the detection vector acquisition module 1540 includes: a feature information acquisition unit 1541 and a corresponding vector acquisition unit 1542.

[0213] The feature information acquisition unit 1541 is used to extract features from the reference time-series variable and the processed target time-series variable through the feature extraction networks contained in the two detection networks respectively, so as to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the processed target time-series variable.

[0214] The corresponding vector acquisition unit 1542 is used to perform discrimination processing on the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable through the discrimination cluster networks contained in the two detection networks respectively, so as to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

[0215] In some embodiments, the feature extraction network includes m cascaded extension modules, each extension module including an extended encoder and a feature fully connected layer, where m is an integer greater than 1; the feature information acquisition unit 1541 is used for:

[0216] The reference time series variable and the processed target time series variable are respectively input into the first extension module of the two feature extraction networks;

[0217] The extended encoder of the extended module extracts the correlation between different time steps and the correlation between different variables from its own input data to obtain the extracted features as the input data of the feature fully connected layer of the extended module.

[0218] The feature fully connected layer of the extended module performs dimensionality upscaling and dimensionality reduction on its own input data, and the processed features are used as the input data of the extended encoder of the next extended module.

[0219] The output data of the feature fully connected layer of the last extension module in each of the two feature extraction networks are obtained to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the processed target time-series variable.

[0220] In some embodiments, the discriminative cluster network includes p sub-networks, where p is the number of grid points contained in the target time-series variable, and p is an integer greater than 1; the corresponding vector acquisition unit 1542 is used for:

[0221] The feature information corresponding to the reference time series variable is input into p sub-networks contained in the first discriminant cluster network, and the p sub-networks contained in the first discriminant cluster network perform discrimination processing to output p vectors corresponding to the reference time series variable; wherein, the first discriminant cluster network is the discriminant cluster network contained in the detection network used to process the reference time series variable among the two detection networks;

[0222] The feature information corresponding to the processed target time-series variable is input into p sub-networks contained in the second discriminant cluster network, and the p sub-networks contained in the second discriminant cluster network perform discrimination processing to output p vectors corresponding to the processed target time-series variable; wherein, the second discriminant cluster network is the discriminant cluster network contained in the detection network used to process the processed target time-series variable among the two detection networks.

[0223] In some embodiments, the anomaly confidence acquisition module 1550 is used for:

[0224] For the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the processed target time series variable, calculate the similarity between the two vectors corresponding to the same grid point;

[0225] Based on the similarity of each grid point in the processed target time series variable, the anomaly confidence level of each grid point in the processed target time series variable is determined.

[0226] In some embodiments, the apparatus further includes a position embedding matrix overlay module 1570.

[0227] The location embedding matrix superposition module 1570 is used to superimpose the reference temporal variable and the processed target temporal variable with location embedding matrices respectively to obtain superimposed reference temporal variables and superimposed target temporal variables; wherein, the superimposed reference temporal variables and the superimposed target temporal variables are used as inputs to the two detection networks, the location embedding matrix contains location embedding vectors corresponding to each grid point, any two grid points at the same time step have the same location embedding vector, any two grid points at different time steps have different location embedding vectors, and the location embedding vectors are dynamically learned and updated during model training.

[0228] Please refer to Figure 17 This diagram illustrates a block diagram of an anomaly detection device for time-series data according to an embodiment of this application. The device has the function of implementing the aforementioned anomaly detection method for time-series data. This function can be implemented in hardware or by hardware executing corresponding software. The device can be the model-using device described above, or it can be installed within the model-using device. The device 1700 may include: a dataset acquisition module 1710, a detection data extraction module 1720, a detection vector acquisition module 1730, and an anomaly confidence acquisition module 1740.

[0229] The dataset acquisition module 1710 is used to acquire the time series dataset to be detected. The time series dataset to be detected includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1.

[0230] The detection data extraction module 1720 is used to extract a set of corresponding reference time series variables and target time series variables from the time series dataset to be detected; wherein, the reference time series variables include data of at least one time step contained in the first time series of the n different variables, and the target time series variables include data of at least one time step contained in the second time series of the n different variables, and the time domain position of the first time series is located before the time domain position of the second time series.

[0231] The detection vector acquisition module 1730 is used to process the reference time series variable and the target time series variable respectively through two detection networks included in the anomaly detection model to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0232] The anomaly confidence acquisition module 1740 is used to determine the anomaly confidence corresponding to each grid point in the target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0233] In some embodiments, the detection network includes a feature extraction network and a discriminative cluster network; such as Figure 19 As shown, the detection vector acquisition module 1730 includes: a feature information acquisition unit 1731 and a corresponding vector acquisition unit 1732.

[0234] The feature information acquisition unit 1731 is used to extract features from the reference time-series variable and the target time-series variable respectively through the feature extraction networks contained in the two detection networks, so as to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the target time-series variable.

[0235] The corresponding vector acquisition unit 1732 is used to perform discrimination processing on the feature information corresponding to the reference time series variable and the feature information corresponding to the target time series variable through the discrimination cluster network contained in the two detection networks respectively, so as to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

[0236] In some embodiments, the feature extraction network includes m cascaded extension modules, each extension module including an extended encoder and a feature fully connected layer, where m is an integer greater than 1; the feature information acquisition unit 1731 is used for:

[0237] The reference time series variable and the target time series variable are respectively input into the first extension module of the two feature extraction networks;

[0238] The extended encoder of the extended module extracts the correlation between different time steps and the correlation between different variables from its own input data to obtain the extracted features as the input data of the feature fully connected layer of the extended module.

[0239] The feature fully connected layer of the extended module performs dimensionality upscaling and dimensionality reduction on its own input data, and the processed features are used as the input data of the extended encoder of the next extended module.

[0240] The output data of the feature fully connected layer of the last extension module in each of the two feature extraction networks are obtained to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the target time-series variable.

[0241] In some embodiments, the discriminative cluster network includes p sub-networks, where p is the number of grid points contained in the target time-series variable, and p is an integer greater than 1; the corresponding vector acquisition unit 1732 is used for:

[0242] The feature information corresponding to the reference time series variable is input into p sub-networks contained in the first discriminant cluster network, and the p sub-networks contained in the first discriminant cluster network perform discrimination processing to output p vectors corresponding to the reference time series variable; wherein, the first discriminant cluster network is the discriminant cluster network contained in the detection network used to process the reference time series variable among the two detection networks;

[0243] The feature information corresponding to the target time series variable is input into p sub-networks contained in the second discriminant cluster network, and the p sub-networks contained in the second discriminant cluster network perform discrimination processing to output p vectors corresponding to the target time series variable; wherein, the second discriminant cluster network is the discriminant cluster network contained in the detection network used to process the target time series variable among the two detection networks.

[0244] In some embodiments, the anomaly confidence acquisition module 1740 is used for:

[0245] For the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the target time series variable, calculate the similarity between the two vectors corresponding to the same grid point;

[0246] Based on the similarity of each grid point in the target time series variable, the anomaly confidence level of each grid point in the target time series variable is determined.

[0247] Please refer to Figure 19 This illustration shows a schematic diagram of a computer device provided in one embodiment of this application. The computer device can be any electronic device with data computing, processing, and storage functions, such as a mobile phone, tablet computer, PC (Personal Computer), or server. The computer device can be the model training device or model usage device described above, used to implement the training method of the anomaly detection model in the above embodiments or to implement the anomaly detection method for the above time-series data.

[0248] In some embodiments, the computer device 1910 includes a central processing unit (such as a CPU, GPU, or FPGA) 1901, a system memory 1904 including RAM (Random-Access Memory) 1902 and ROM (Read-Only Memory) 1903, and a system bus 1905 connecting the system memory 1904 and the central processing unit 1901. The computer device 1900 also includes a basic input / output system 1906 that facilitates information transfer between various devices within the server, and a mass storage device 1907 for storing the operating system 1913, application programs 1914, and other program modules 1915.

[0249] In some embodiments, the basic input / output system 1906 includes a display 1908 for displaying information and an input device 1909 for inputting information, such as a mouse or keyboard. Both the display 1908 and the input device 1909 are connected to the central processing unit 1901 via an input / output controller 1910 connected to the system bus 1905. The basic input / output system 1906 may also include the input / output controller 1910 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 1910 also provides output to a display screen, printer, or other types of output devices.

[0250] In some embodiments, the mass storage device 1907 is connected to the central processing unit 1901 via a mass storage controller (not shown) connected to the system bus 1905. The mass storage device 1907 and its associated computer-readable media provide non-volatile storage for the computer device 1900. That is, the mass storage device 1907 may include computer-readable media (not shown) such as a hard disk or a CD-ROM (Compact Disc Read-Only Memory) drive.

[0251] Without loss of generality, the computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other solid-state storage technologies, CD-ROM, DVD (Digital Video Disc) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer storage medium is not limited to the above-mentioned types. The system memory 1904 and mass storage device 1907 described above can be collectively referred to as memory.

[0252] According to embodiments of this application, the computer device 1900 can also be connected to a remote computer on a network, such as the Internet. That is, the computer device 1900 can be connected to a network 1912 via a network interface unit 1911 connected to the system bus 1905, or it can use the network interface unit 1911 to connect to other types of networks or remote computer systems (not shown).

[0253] In some embodiments, the memory further includes a computer program stored in the memory and configured to be executed by one or more processors to implement the above-described training method for the anomaly detection model or the above-described anomaly detection method for time-series data.

[0254] In an exemplary embodiment, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor of a computer device, implements the training method for the above-described anomaly detection model or the anomaly detection method for the above-described time-series data.

[0255] Optionally, the computer-readable storage medium may include: ROM (Read-Only Memory), RAM (Random-Access Memory), SSD (Solid State Drives), or optical disc, etc. The random access memory may include ReRAM (Resistance Random Access Memory) and DRAM (Dynamic Random Access Memory).

[0256] In an exemplary embodiment, a computer program product or computer program is also provided, comprising computer instructions stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the training method for the aforementioned anomaly detection model or the anomaly detection method for the aforementioned time-series data.

[0257] It should be noted that if the time series data collected during the implementation of this application is user-related data, user permission or consent must be obtained, and the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0258] It should be understood that "multiple" as used herein refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. Furthermore, the step numbers described herein are merely illustrative of one possible execution order. In some other embodiments, the steps may not be executed in numerical order, such as two steps with different numbers being executed simultaneously, or two steps with different numbers being executed in the reverse order of the illustration. This application does not limit this.

[0259] The above are merely exemplary embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application shall be included within the protection scope of this application.

Claims

1. A training method for an anomaly detection model, characterized in that, The method is performed by a computer device, and the method includes: Obtain a historical time series dataset, which includes time series data of n different variables, and the time series data of each variable includes data of multiple time steps, where n is an integer greater than 1; wherein, in the scenario of detecting abnormal physical indicators, the n different variables include at least two of the following: heart rate, pulse rate, blood pressure value, and respiratory rate; Multiple training samples are extracted from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of at least one time step of the n different variables in the first time series, and the target time series variables include data of at least one time step of the n different variables in the second time series. The time domain position of the first time series is located before the time domain position of the second time series. The target time series variable is subjected to mixed sample generation processing to obtain the processed target time series variable and sample label information; wherein, the sample label information includes the sample label corresponding to each grid point in the processed target time series variable, each grid point corresponds to the data of a variable in one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample; The anomaly detection model uses two detection networks to process the reference time series variable and the processed target time series variable, respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable. Based on the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the processed target time series variable, the anomaly confidence level corresponding to each grid point in the processed target time series variable is determined. Based on the anomaly confidence and sample label corresponding to each grid point in the processed target time series variable, the network parameters of the anomaly detection model are adjusted; wherein, the trained anomaly detection model is used to determine the anomalies in the time series data of the n different variables included in the time series dataset to be detected.

2. The method according to claim 1, characterized in that, The processed target time-series variable and the sample label information are obtained through a hybrid sample generator, which includes an iterative autoencoder and a negative sample generator. The process of generating mixed samples for the target time-series variable to obtain the processed target time-series variable and sample label information includes: The target time series variable is processed by the iterative autoencoder, causing each data point in the target time series variable to shrink towards the global mean, thus obtaining the reconstructed target time series variable. The reconstructed target time series variable is processed by the negative sample generator to obtain negative sample time series variables; wherein, the data of each grid point in the negative sample time series variables are all negative samples; The target time series variable and the negative sample time series variable are integrated to obtain the processed target time series variable and the sample label information.

3. The method according to claim 2, characterized in that, The process of processing the reconstructed target time-series variable using the negative sample generator to obtain the negative sample time-series variable includes: Multiple random number generation algorithms are used to generate multiple random number matrices with the same number of grid points as the reconstructed target time series variable; The multiple random number matrices are weighted and summed to obtain a summation matrix; The summation matrix is ​​added to the reconstructed target time series variable to obtain the negative sample time series variable.

4. The method according to claim 3, characterized in that, The weighted summation of the plurality of random number matrices to obtain the negative sample time series variables includes: A weight matrix is ​​generated based on the intermediate vector obtained during the processing of the target time-series variable by the iterative autoencoder. The weight matrix includes the weight values ​​corresponding to the plurality of random number matrices. Generate a random discard matrix, which includes discard values ​​corresponding to the plurality of random number matrices, and the discard values ​​are used to indicate whether to discard the random number matrices; The negative sample time series variable is obtained by multiplying the multiple random number matrices by their corresponding weight values ​​and discard values, and then summing the results.

5. The method according to claim 2, characterized in that, The step of integrating the target time-series variable and the negative sample time-series variable to obtain the processed target time-series variable and the sample label information includes: The processed target time series variable is constructed by selecting a portion of grid data from the target time series variable and a portion of grid data from the negative sample time series variable. Data from the target time series variable in the processed target time series variable are identified as positive samples; and data from the negative sample time series variable in the processed target time series variable are identified as negative samples. Based on the determination results of the positive and negative samples, the sample label information is obtained.

6. The method according to claim 1, characterized in that, The detection network includes a feature extraction network and a discriminative cluster network; The anomaly detection model uses two detection networks to process the reference time-series variable and the processed target time-series variable, respectively, to obtain multiple vectors corresponding to the reference time-series variable and multiple vectors corresponding to the processed target time-series variable, including: The feature extraction networks contained in the two detection networks are used to extract features from the reference time series variable and the processed target time series variable, respectively, to obtain the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable. The discriminant cluster networks contained in the two detection networks are used to discriminate the feature information corresponding to the reference time series variable and the feature information corresponding to the processed target time series variable, respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable.

7. The method according to claim 6, characterized in that, The feature extraction network includes m cascaded extension modules, each of which includes an extended encoder and a feature fully connected layer, where m is an integer greater than 1. The step involves extracting features from the reference time-series variable and the processed target time-series variable using feature extraction networks included in the two detection networks, respectively, to obtain feature information corresponding to the reference time-series variable and feature information corresponding to the processed target time-series variable, including: The reference time series variable and the processed target time series variable are respectively input into the first extension module of the two feature extraction networks; The extended encoder of the extended module extracts the correlation between different time steps and the correlation between different variables from its own input data to obtain the extracted features as the input data of the feature fully connected layer of the extended module. The feature fully connected layer of the extended module performs dimensionality upscaling and dimensionality reduction on its own input data, and the processed features are used as the input data of the extended encoder of the next extended module. The output data of the feature fully connected layer of the last extension module in each of the two feature extraction networks are obtained to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the processed target time-series variable.

8. The method according to claim 6, characterized in that, The discriminative cluster network includes p sub-networks, where p is the number of grid points contained in the target time-series variable, and p is an integer greater than 1; The discriminant cluster networks included in the two detection networks are used to discriminate the feature information corresponding to the reference time-series variable and the feature information corresponding to the processed target time-series variable, respectively, to obtain multiple vectors corresponding to the reference time-series variable and multiple vectors corresponding to the processed target time-series variable, including: The feature information corresponding to the reference time series variable is input into p sub-networks contained in the first discriminant cluster network, and the p sub-networks contained in the first discriminant cluster network perform discrimination processing to output p vectors corresponding to the reference time series variable; wherein, the first discriminant cluster network is the discriminant cluster network contained in the detection network used to process the reference time series variable among the two detection networks; The feature information corresponding to the processed target time-series variable is input into p sub-networks contained in the second discriminant cluster network, and the p sub-networks contained in the second discriminant cluster network perform discrimination processing to output p vectors corresponding to the processed target time-series variable; wherein, the second discriminant cluster network is the discriminant cluster network contained in the detection network used to process the processed target time-series variable among the two detection networks.

9. The method according to claim 1, characterized in that, The step of determining the anomaly confidence level corresponding to each grid point in the processed target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable includes: For the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the processed target time series variable, calculate the similarity between the two vectors corresponding to the same grid point; Based on the similarity of each grid point in the processed target time series variable, the anomaly confidence level of each grid point in the processed target time series variable is determined.

10. The method according to any one of claims 1 to 9, characterized in that, The method further includes: The reference time series variable and the processed target time series variable are respectively superimposed with a position embedding matrix to obtain the superimposed reference time series variable and the superimposed target time series variable; The superimposed reference temporal variable and the superimposed target temporal variable serve as inputs to the two detection networks. The location embedding matrix contains location embedding vectors corresponding to each grid point. Any two grid points at the same time step have the same location embedding vector, while any two grid points at different time steps have different location embedding vectors. The location embedding vectors are dynamically learned and updated during model training.

11. A method for anomaly detection in time-series data, characterized in that, The method is performed by a computer device, and the method includes: Obtain the time series dataset to be detected, which includes time series data of n different variables, and the time series data of each variable includes data of multiple time steps, where n is an integer greater than 1; wherein, in the scenario of detecting abnormal physical indicators, the n different variables include at least two of the following: heart rate, pulse rate, blood pressure value, and respiratory rate; Extract a set of corresponding reference time series variables and target time series variables from the time series dataset to be detected; wherein, the reference time series variables include data of at least one time step of the n different variables contained in the first time series, and the target time series variables include data of at least one time step of the n different variables contained in the second time series, wherein the time domain position of the first time series is located before the time domain position of the second time series; The anomaly detection model uses two detection networks to process the reference time series variable and the target time series variable respectively, resulting in multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable. Based on the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the target time series variable, the anomaly confidence level corresponding to each grid point in the target time series variable is determined. Based on the anomaly confidence level corresponding to each grid point in the target time series variable, the outliers in the time series data of the n different variables included in the time series dataset to be detected are determined.

12. The method according to claim 11, characterized in that, The detection network includes a feature extraction network and a discriminative cluster network; The anomaly detection model uses two detection networks to process the reference time-series variable and the target time-series variable respectively, resulting in multiple vectors corresponding to the reference time-series variable and multiple vectors corresponding to the target time-series variable, including: By using the feature extraction networks contained in the two detection networks, features are extracted from the reference time series variable and the target time series variable respectively, so as to obtain the feature information corresponding to the reference time series variable and the feature information corresponding to the target time series variable. The discriminant cluster networks contained in the two detection networks are used to discriminate the feature information corresponding to the reference time series variable and the feature information corresponding to the target time series variable, respectively, to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable.

13. The method according to claim 12, characterized in that, The feature extraction network includes m cascaded extension modules, each of which includes an extended encoder and a feature fully connected layer, where m is an integer greater than 1. The step involves extracting features from the reference time-series variable and the target time-series variable using feature extraction networks included in the two detection networks, respectively, to obtain feature information corresponding to the reference time-series variable and feature information corresponding to the target time-series variable, including: The reference time series variable and the target time series variable are respectively input into the first extension module of the two feature extraction networks; The extended encoder of the extended module extracts the correlation between different time steps and the correlation between different variables from its own input data to obtain the extracted features as the input data of the feature fully connected layer of the extended module. The feature fully connected layer of the extended module performs dimensionality upscaling and dimensionality reduction on its own input data, and the processed features are used as the input data of the extended encoder of the next extended module. The output data of the feature fully connected layer of the last extension module in each of the two feature extraction networks are obtained to obtain the feature information corresponding to the reference time-series variable and the feature information corresponding to the target time-series variable.

14. The method according to claim 12, characterized in that, The discriminative cluster network includes p sub-networks, where p is the number of grid points contained in the target time-series variable, and p is an integer greater than 1; The discriminant cluster networks included in the two detection networks are used to perform discriminative processing on the feature information corresponding to the reference time-series variable and the feature information corresponding to the target time-series variable, respectively, to obtain multiple vectors corresponding to the reference time-series variable and multiple vectors corresponding to the target time-series variable, including: The feature information corresponding to the reference time series variable is input into p sub-networks contained in the first discriminant cluster network, and the p sub-networks contained in the first discriminant cluster network perform discrimination processing to output p vectors corresponding to the reference time series variable; wherein, the first discriminant cluster network is the discriminant cluster network contained in the detection network used to process the reference time series variable among the two detection networks; The feature information corresponding to the target time series variable is input into p sub-networks contained in the second discriminant cluster network, and the p sub-networks contained in the second discriminant cluster network perform discrimination processing to output p vectors corresponding to the target time series variable; wherein, the second discriminant cluster network is the discriminant cluster network contained in the detection network used to process the target time series variable among the two detection networks.

15. The method according to any one of claims 11 to 14, characterized in that, The step of determining the anomaly confidence level corresponding to each grid point in the target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable includes: For the multiple vectors corresponding to the reference time series variable and the multiple vectors corresponding to the target time series variable, calculate the similarity between the two vectors corresponding to the same grid point; Based on the similarity of each grid point in the target time series variable, the anomaly confidence level of each grid point in the target time series variable is determined.

16. A training device for an anomaly detection model, characterized in that, The device includes: The dataset acquisition module is used to acquire a historical time series dataset, which includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1. In the scenario of abnormal detection of physical indicators, the n different variables include at least two of the following: heart rate, pulse rate, blood pressure value, and respiratory rate. The training sample acquisition module is used to extract multiple training samples from the historical time series dataset. Each training sample includes a set of corresponding reference time series variables and target time series variables. The reference time series variables include data of at least one time step of the n different variables in the first time series, and the target time series variables include data of at least one time step of the n different variables in the second time series. The time domain position of the first time series is located before the time domain position of the second time series. A mixed sample acquisition module is used to perform mixed sample generation processing on the target time series variable to obtain the processed target time series variable and sample label information; wherein, the sample label information includes the sample label corresponding to each grid point in the processed target time series variable, each grid point corresponds to the data of a variable in one time step, and the sample label is used to indicate whether the data corresponding to the grid point is a positive sample or a negative sample. The detection vector acquisition module is used to process the reference time series variable and the processed target time series variable respectively through the two detection networks included in the anomaly detection model to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable. The anomaly confidence acquisition module is used to determine the anomaly confidence corresponding to each grid point in the processed target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the processed target time series variable. The network parameter adjustment module is used to adjust the network parameters of the anomaly detection model according to the anomaly confidence and sample label corresponding to each grid point in the processed target time series variable; wherein, the trained anomaly detection model is used to determine the anomaly points in the time series data of the n different variables included in the time series dataset to be detected.

17. An anomaly detection device for time-series data, characterized in that, The device includes: The dataset acquisition module is used to acquire the time series dataset to be detected. The time series dataset to be detected includes time series data of n different variables. The time series data of each variable includes data of multiple time steps, where n is an integer greater than 1. In the scenario of detecting abnormal physical indicators, the n different variables include at least two of the following: heart rate, pulse rate, blood pressure value, and respiratory rate. The detection data extraction module is used to extract a set of corresponding reference time series variables and target time series variables from the time series dataset to be detected; wherein, the reference time series variables include data of at least one time step contained in the first time series of the n different variables, and the target time series variables include data of at least one time step contained in the second time series of the n different variables, and the time domain position of the first time series is located before the time domain position of the second time series; The detection vector acquisition module is used to process the reference time series variable and the target time series variable respectively through two detection networks included in the anomaly detection model to obtain multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable; The anomaly confidence acquisition module is used to determine the anomaly confidence corresponding to each grid point in the target time series variable based on multiple vectors corresponding to the reference time series variable and multiple vectors corresponding to the target time series variable; and to determine the outliers in the time series data of the n different variables included in the time series dataset to be detected based on the anomaly confidence corresponding to each grid point in the target time series variable.

18. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing a computer program that is loaded and executed by the processor to implement the method as claimed in any one of claims 1 to 10, or to implement the method as claimed in any one of claims 11 to 15.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that is loaded and executed by a processor to implement the method as described in any one of claims 1 to 10, or to implement the method as described in any one of claims 11 to 15.

20. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, which a processor reads from and executes to implement the method as claimed in any one of claims 1 to 10, or to implement the method as claimed in any one of claims 11 to 15.

Images