A time series data anomaly detection method, device, equipment and storage medium

Abstract

The application discloses a kind of abnormality detection method, device and equipment of time series data and storage medium.The method comprises: obtaining time series data to be detected;The time series data to be detected is input into target local anomaly detection model, and first state time series data is obtained;The time series data to be detected is input into target anomaly detection network model, and second state time series data is obtained, and target anomaly detection network model is a deep learning model based on data reconstruction error;According to first state time series data and second state time series data, determine the abnormal state data in time series data to be detected, realize the detection precision of time series data is improved, and the normal operation of business platform is guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data detection, and particularly relates to a time series data anomaly detection method and device, equipment and a storage medium. BACKGROUND

[0002] With the continuous development of big data and artificial intelligence technologies, the data generated in real time on a business platform increases exponentially, which makes it more and more difficult to detect data on a daily basis.

[0003] At present, the detection accuracy of existing data detection models for time series data is not ideal, which leads to inaccurate anomaly detection of time series data and does not facilitate the normal operation of the business platform. SUMMARY

[0004] The present application provides a time series data anomaly detection method, device, equipment and storage medium to solve the problem of low detection accuracy of existing data detection models for time series data, improve the detection accuracy of time series data and ensure the normal operation of the business platform.

[0005] According to one aspect of the present application, a time series data anomaly detection method is provided, comprising:

[0006] obtaining time series data to be detected;

[0007] inputting the time series data to be detected into a target local anomaly detection model to obtain first state time series data;

[0008] inputting the time series data to be detected into a target anomaly detection network model to obtain second state time series data, the target anomaly detection network model being a deep learning model based on data reconstruction error;

[0009] determining abnormal state data in the time series data to be detected according to the first state time series data and the second state time series data.

[0010] According to another aspect of the present application, a time series data anomaly detection device is provided, comprising:

[0011] a data acquisition module for acquiring time series data to be detected;

[0012] a first detection module for inputting the time series data to be detected into a target local anomaly detection model to obtain first state time series data;

[0013] a second detection module for inputting the time series data to be detected into a target anomaly detection network model to obtain second state time series data, the target anomaly detection network model being a deep learning model based on data reconstruction error;

[0014] determining module, configured to determine abnormal state data in the to-be-detected time series data according to the first state time series data and the second state time series data.

[0015] According to another aspect of the present application, an electronic device is provided, which comprises:

[0016] at least one processor; and

[0017] a memory connected to the at least one processor in communication; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the abnormality detection method of time series data according to any one of the embodiments of the present application.

[0019] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to perform the abnormality detection method of time series data according to any one of the embodiments of the present application.

[0020] The technical scheme of the embodiments of the present application comprises the following steps: obtaining to-be-detected time series data; inputting the to-be-detected time series data into a target local anomaly detection model to obtain first state time series data; inputting the to-be-detected time series data into a target anomaly detection network model to obtain second state time series data, the target anomaly detection network model being a deep learning model based on data reconstruction error; determining abnormal state data in the to-be-detected time series data according to the first state time series data and the second state time series data, thereby improving the detection accuracy of non-continuous time series data, ensuring the normal operation of a business platform, and solving the problem of low detection accuracy of time series data by existing data detection models, and achieving the beneficial effects of improving the detection accuracy of time series data and ensuring the normal operation of a business platform.

[0021] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0023] Figure 1is a flow chart of an abnormality detection method of time series data provided by an embodiment of the present application;

[0024] Figure 2 is an architecture diagram of an abnormality detection network model provided by an embodiment of the present application;

[0025] Figure 3 is a structural schematic diagram of an abnormality detection device of time series data provided by an embodiment two of the present application;

[0026] Figure 4 is a structural schematic diagram of an electronic device implementing the abnormality detection method of time series data of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment one

[0030] Figure 1 A flow chart of an abnormality detection method of time series data is provided for an embodiment one of the present application. The present embodiment can be applicable to the abnormality detection of non-continuous time series data. The method can be executed by an abnormality detection device of time series data, which can be realized in the form of hardware and / or software, and can be configured in an electronic device. As shown in the figure, the method comprises: Figure 1

[0031] S110, acquiring time series data to be detected.

[0032] ​The to-be-detected time series data can be understood as time series data to be detected, for example, to-be-detected data obtained by sampling at a preset sampling frequency within a preset time period.

[0033] Optionally, the to-be-detected time series data comprises:

[0034] The to-be-detected data corresponding to each sampling time point within a preset time period is obtained at a preset sampling frequency, and the to-be-detected time series data is constructed according to the to-be-detected data of each sampling time point.

[0035] For example, data is sampled at a sampling frequency of 1 minute within a week, and the to-be-detected time series data obtained by sampling each day can be to-be-detected time series data with 24*60=1440 time series points (i.e., sampling time points).

[0036] It should be noted that the sampling frequencies of various types of time series data can be different (for example, 1 minute, 5 minutes), and the sampling frequency of the time series data needs to be obtained. The data missing condition of the to-be-detected time series data is determined according to the sampling frequency, and the to-be-detected time series data is preprocessed, for example, the dates with too much missing data are removed.

[0037] S120, input the to-be-detected time series data into the target local anomaly detection model to obtain first state time series data.

[0038] The target local anomaly detection model can be understood as a complete local anomaly detection model obtained by training an initial local anomaly detection model based on historical time series data. The target local anomaly detection model can be a model established based on a local outlier factor (LOF). The target anomaly detection model based on the local outlier factor is a density-based outlier detection model. The principle of the target local anomaly detection model is that the density around a non-outlier object is similar to the density around its neighborhood, and the density around an outlier object is significantly different from the density around its neighborhood. The state time series data can be understood as time series data composed of the states of each to-be-detected data in the to-be-detected time series data. The first state time series data is the state time series data of the to-be-detected time series data obtained by the target anomaly detection model.

[0039] Specifically, the to-be-detected time series data is input into the trained target local anomaly detection model, and the first state time series data can be output to reflect the data state of each to-be-detected data detected by the target local anomaly detection model.

[0040] S130, input the to-be-detected time series data into the target anomaly detection network model to obtain second state time series data, and the target anomaly detection network model is a deep learning model based on data reconstruction error.

[0041] The target anomaly detection network model can be understood as a trained complete anomaly detection network model, and in the embodiment of the present application, the target anomaly detection network model can be a deep learning model based on data reconstruction error. The second state time series data is state time series data of the to-be-detected time series data obtained by the target anomaly detection network model.

[0042] Specifically, the to-be-detected time series data is input into the trained complete target anomaly detection network model, and the second state time series data can be output to reflect the data state of each to-be-detected data detected by the to-be-detected time series data through the target anomaly detection network model.

[0043] S140, determining the abnormal state data in the to-be-detected time series data according to the first state time series data and the second state time series data.

[0044] Specifically, the state of the to-be-detected data is determined according to the state of the to-be-detected data corresponding to each time series point in the first state time series data and the second state time series data, so as to determine the abnormal state data in the to-be-detected time series data.

[0045] For example, the way to determine the state of the to-be-detected data according to the first state time series data and the second state time series data can be: if the state of the to-be-detected data corresponding to each time series point in the first state time series data and the second state time series data is abnormal, it is determined that the to-be-detected data is abnormal state data, and the remaining to-be-detected data is normal state data; or it can be: if the state of the to-be-detected data corresponding to each time series point in the first state time series data and the second state time series data is normal, it is determined that the to-be-detected data is normal state data, and the remaining to-be-detected data is abnormal state data.

[0046] The technical scheme of the embodiment of the present application comprises the following steps: obtaining to-be-detected time series data; inputting the to-be-detected time series data into a target local anomaly detection model to obtain first state time series data; inputting the to-be-detected time series data into a target anomaly detection network model to obtain second state time series data, the target anomaly detection network model being a deep learning model based on data reconstruction error; and determining abnormal state data in the to-be-detected time series data according to the first state time series data and the second state time series data, thereby improving the detection accuracy of non-continuous time series data, ensuring the normal operation of the business platform, and solving the problem of low detection accuracy of time series data by the existing data detection model, thereby improving the detection accuracy of time series data and ensuring the normal operation of the business platform.

[0047] Optionally, the training steps of the target local anomaly detection model comprise:

[0048] obtain historical time series data, and obtain time series data samples by using a time window to intercept the historical time series data;

[0049] input first sample data in the time series data samples into an initial local anomaly detection model, and determine a local anomaly factor of the first sample data;

[0050] determine abnormal time series data according to the local anomaly factor of the first sample data, and correct abnormal sample data in the time series data samples to obtain time series data update samples;

[0051] update the time series data samples by using the time series data update samples;

[0052] recursively slide the time window by a preset sliding step, and return to the step of obtaining the time series data samples by using the time window to intercept the historical time series data until there is no abnormal sample data in the historical time series data, and obtain a target local anomaly detection model.

[0053] The historical time series data can be time series data obtained in a historical time period at a current time. The historical time series data is intercepted by using the time window, and time series data samples composed of historical data corresponding to time points contained in the time window can be obtained. The sample data contained in the time series data samples is referred to as first sample data.

[0054] The initial local anomaly detection model can be:

[0055]

[0056] wherein p and o are two first sample data in the time series data samples, LOF k (p) is a local outlier factor of the first sample data p in a k-distance neighborhood, N k (p) is the k-distance neighborhood of the first sample data p, |N k (p) is the number of data points in the k-distance neighborhood of the first sample data p, lrd k (p) is a local reachable density of the first sample data p, which is represented as the reciprocal of the average reachable distance of data points in the k-neighborhood of the first sample data p to the first sample data p; similarly, lrd k (o) is a local reachable density of the first sample data o, which is represented as the reciprocal of the average reachable distance of data points in the k-neighborhood of the first sample data o to the first sample data o.

[0057] Specifically, the time series data samples are input into the initial local anomaly detection model to determine the local anomaly factor of each sample data in the time series data samples. According to the local anomaly factor of the sample data, the data state of the sample data can be determined. For example, if LOF kIf (p) >= 1, the first sample data p is an outlier, that is, abnormal sample data; if (p) < 1, the first sample data is normal sample data. The abnormal sample data in the time series data sample is corrected to obtain a time series data update sample. k If (p) < 1, the first sample data is normal sample data. The abnormal sample data in the time series data sample is corrected to obtain a time series data update sample.

[0058] The time series data sample is updated by using the time series data update sample, and the time window is cyclically moved by a preset sliding step. The step of obtaining the time series data sample by using the time window to intercept the historical time series data is returned. The time series data sample obtained the second time is compared with the time series data sample obtained the first time, and the sampling time point is moved by a preset sliding step, and part of the abnormal sample data is corrected to normal sample data. In the embodiment of the application, for each first sample data, a cyclic modeling method is adopted for iterative optimization, that is, the time window is moved in a cyclic manner. When the current time window is moved to the last first sample data position of the time series data sample, it is returned to the first first sample data position of the time series data sample. This is repeated until there is no longer any abnormal sample data in the historical time series data. At this time, the initial local anomaly detection model is trained and completed, and the trained initial local anomaly detection model is determined as the target local anomaly detection model.

[0059] For example, the abnormal sample data in the time series data sample can be corrected to obtain a time series data update sample in the following manner: determining an update sample data according to the mean value of all first sample data in the time series data sample, and replacing the abnormal sample data in the time series data sample with the update sample data to correct the abnormal sample data in the time series data sample to obtain a time series data update sample.

[0060] Optionally, the to-be-detected time series data is input into the target local anomaly detection model to obtain first state time series data, including:

[0061] The to-be-detected data in the to-be-detected time series data is input into the target local anomaly detection model to obtain a local anomaly factor of each to-be-detected data.

[0062] The data state of each to-be-detected data is determined according to the local anomaly factor to form first state time series data; the data state includes: normal state or abnormal state.

[0063] In the target local anomaly detection model, p is a to-be-detected data point input at the current time in the to-be-detected time series data, and o is a data point in the historical time series data.

[0064] Specifically, the to-be-detected time series data is input into the trained target local anomaly detection model to obtain a local anomaly factor LOF kAccording to the local anomaly factor of the to-be-detected data, the data state of the to-be-detected data can be determined, and according to the data state of each to-be-detected data in the detection time series data being normal or abnormal, the first state time series data corresponding to the detection time series data can be formed.

[0065] For example, if the to-be-detected time series data P is p1, p2, …, p n-1 , p n , the first state time series data can be o p1 , e p2 , …, e pn-1 , o pn , wherein o p1 indicates that the data state of the to-be-detected data p1 in the to-be-detected time series data is normal; e p2 indicates that the data state of the to-be-detected data p2 in the to-be-detected time series data is abnormal.

[0066] Optionally, the training step of the target anomaly detection network model comprises:

[0067] inputting the second sample data into the initial anomaly detection network model to generate reconstruction data; the second sample data is sample data contained in the historical time series data finally updated in the training step of the target local anomaly detection model;

[0068] determining a loss function value of the reconstruction data and the second sample data;

[0069] adjusting parameters of the initial anomaly detection network model based on the loss function;

[0070] returning to execute the step of inputting the second sample data into the initial anomaly detection network model to generate reconstruction data until the loss function value is less than a preset threshold, and obtaining the target anomaly detection network model.

[0071] In the training step of the target local anomaly detection model, after each training of the initial local anomaly detection model, the time series data sample obtained by intercepting the historical time series data with a time window is updated, so that the historical time series data is updated. After multiple training, there is no abnormal sample data in the historical time series data, and the sample data contained in the finally updated historical time series data without abnormal sample data is determined as the second sample data. That is, the historical time series data without abnormal sample data updated by the target local anomaly detection model is used as the sample data input into the initial anomaly detection network model.

[0072] For example, the anomaly detection network model can be an LSTM-VAE model, and the model architecture of the anomaly detection network model is as shown in Figure 2 In the anomaly detection network model shown in Figure 2 , the model parameters of the anomaly detection network model are as follows:

[0073] c t =z f ⊙c t-1 +z i ⊙z;

[0074] h t =z o ⊙tanh(c t );

[0075] y t =σ(W′h′);

[0076] where h t-1 is the output result of the previous unit, x t is the second sample data of the current input, c t-1 is the state information of the previous unit, c t is the state information of the current unit, y t is the output result of the initial anomaly detection network model, z f , z i , z, z o , W' and σ are model parameters of the initial anomaly detection network model.

[0077] In the embodiment of the application, the stability of the anomaly detection model is improved by fusing the settings of the multi-layer data detection model. First, in the initial rough detection (i.e., the initial detection of the to-be-detected time series data by using the target local anomaly detection model), the anomaly detection is performed by using the traditional machine learning method, so that the particularly serious abnormal values can be removed, and the original data is smoothed. In the secondary detailed detection (i.e., the secondary detection of the to-be-detected time series data by using the target anomaly detection network model), the output updated historical time series data after the initial rough detection is used in the model training of the target anomaly detection network model, and the self-encoder algorithm in deep learning is combined to obtain a more refined model, which greatly improves the accuracy of the anomaly detection.

[0078] Optionally, determining the abnormal state data in the to-be-detected time series data according to the first state time series data and the second state time series data comprises:

[0079] determining the data in the first state time series data and the second state time series data as the abnormal state data in the to-be-detected time series data at the same time series point.

[0080] Specifically, if the state data corresponding to the to-be-detected data is an abnormal state in the first state time series data and the second state time series data, the to-be-detected data is determined as the abnormal state data, and so on, to determine the abnormal state data in the to-be-detected time series data.

[0081] For example, if the to-be-detected timing data P is p1, p2, p3, p4, p5, p6, the first state timing data is o p1 , e p2 , e p3 , o p4 , o p5 , o p6 , the second state timing data is o` p1 , e` p2 , o` p3 , o` p4 , e` p5 , o` p6 , it is determined that the abnormal state data p2 in the to-be-detected timing data P.

[0082] Embodiment two

[0083] Figure 3 A structure diagram of an abnormality detection device for timing data provided by the second embodiment of the present application is shown in FIG. 2. As shown in FIG. 2, the device comprises a data acquisition module 210, a first detection module 220, a second detection module 230, and a determination module 240. Figure 3

[0084] The data acquisition module 210 is configured to acquire to-be-detected timing data.

[0085] The first detection module 220 is configured to input the to-be-detected timing data into a target local abnormality detection model to obtain first state timing data.

[0086] The second detection module 230 is configured to input the to-be-detected timing data into a target abnormality detection network model to obtain second state timing data, wherein the target abnormality detection network model is a deep learning model based on data reconstruction error.

[0087] The determination module 240 is configured to determine abnormal state data in the to-be-detected timing data according to the first state timing data and the second state timing data.

[0088] Optionally, the data acquisition module 210 is specifically configured to:

[0089] acquire to-be-detected data corresponding to each sampling time point in a preset time period at a preset sampling frequency;

[0090] construct the to-be-detected timing data according to the to-be-detected data of each sampling time point.

[0091] Optionally, the training steps of the target local abnormality detection model comprise:

[0092] ​obtain historical time series data, and obtain time series data samples by intercepting the historical time series data by using a time window;

[0093] input first sample data in the time series data samples into an initial local anomaly detection model, and determine a local anomaly factor of the first sample data;

[0094] determine abnormal time series data according to the local anomaly factor of the first sample data, and correct abnormal sample data in the time series data samples to obtain time series data update samples;

[0095] update the time series data samples by using the time series data update samples;

[0096] cyclically slide the time window by using a preset sliding step, and return to execute the step of obtaining the time series data samples by intercepting the historical time series data by using the time window, until there is no abnormal sample data in the historical time series data, to obtain the target local anomaly detection model.

[0097] Optionally, the first detection module 220 comprises:

[0098] a data input unit configured to input to-be-detected data in the to-be-detected time series data into the target local anomaly detection model, and obtain a local anomaly factor of each to-be-detected data;

[0099] a state determination unit configured to determine a data state of each to-be-detected data according to the local anomaly factor, and form first state time series data; the data state comprises a normal state or an abnormal state.

[0100] Optionally, the training step of the target anomaly detection network model comprises:

[0101] input second sample data into an initial anomaly detection network model to generate reconstruction data; the second sample data is sample data contained in historical time series data finally obtained in the training step of the target local anomaly detection model;

[0102] determine a loss function value of the reconstruction data and the second sample data;

[0103] adjust parameters of the initial anomaly detection network model based on the loss function;

[0104] return to execute the step of inputting the second sample data into the initial anomaly detection network model to generate the reconstruction data, until the loss function value is less than a preset threshold, to obtain a target anomaly detection network model.

[0105] Optionally, the determination module 240 is specifically configured to:

[0106] The data of the first state timing data and the second state timing data which are abnormal state data at the same timing point are determined as the abnormal state data in the to-be-detected timing data.

[0107] The timing data abnormality detection apparatus provided by the embodiments of the present application can execute the timing data abnormality detection method provided by any of the embodiments of the present application, and has the function modules and advantages corresponding to the execution method.

[0108] Embodiment three

[0109] Figure 4 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0110] As shown in Figure 4 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 11 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0111] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, a speaker, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0112] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, and the like. The processor 11 performs various methods and processes described above, such as the anomaly detection method for time series data.

[0113] In some embodiments, the anomaly detection method for time series data can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded onto the RAM 13 and executed by the processor 11, one or more steps of the anomaly detection method for time series data described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the anomaly detection method for time series data by any other suitable means, such as by means of firmware.

[0114] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0115] Computer programs used to implement the methods of the application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, and partially on a machine or a remote machine or a server.

[0116] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0117] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0118] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0119] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0120] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.

[0121] The above detailed description does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for anomaly detection in time-series data, characterized in that, include: Obtain the time series data to be detected; The time series data to be detected is input into the target local anomaly detection model to obtain the first state time series data; The time series data to be detected is input into the target anomaly detection network model to obtain the second state time series data. The target anomaly detection network model is a deep learning model based on data reconstruction error. Based on the first state time series data and the second state time series data, determine the abnormal state data in the time series data to be detected; The training steps of the target local anomaly detection model include: Historical time-series data is acquired, and time-series data samples are obtained by using a time window to extract the historical time-series data. Input the first sample data in the time series data sample into the initial local anomaly detection model to determine the local anomaly factor of the first sample data; Based on the local anomaly factors of the first sample data, abnormal time series data are determined, and the abnormal sample data in the time series data sample is corrected to obtain the updated time series data sample. The time series data sample is updated using the time series data update sample; The time window is cyclically slid with a preset sliding step size, and then the step of using the time window to extract the historical time series data to obtain time series data samples is returned until there are no abnormal sample data in the historical time series data, thus obtaining the target local anomaly detection model. The training steps of the target anomaly detection network model include: The second sample data is input into the initial anomaly detection network model to generate reconstructed data; the second sample data is the sample data contained in the historical time series data finally updated in the training step of the target local anomaly detection model; Determine the loss function values ​​for the reconstructed data and the second sample data; The parameters of the initial anomaly detection network model are adjusted based on the loss function; Return to the step of inputting the second sample data into the initial anomaly detection network model to generate reconstructed data, until the loss function value is less than a preset threshold, and obtain the target anomaly detection network model.

2. The method according to claim 1, characterized in that, The acquisition of the time series data to be detected includes: The detection data corresponding to each sampling time point within a preset time period is acquired at a preset sampling frequency; The time-series data to be detected is constructed based on the data to be detected at each of the sampling time points.

3. The method according to any one of claims 1-2, characterized in that, The step of inputting the time series data to be detected into the target local anomaly detection model to obtain the first state time series data includes: The data to be detected in the time series data to be detected is input into the target local anomaly detection model to obtain the local anomaly factor of each data to be detected. The data state of each data to be detected is determined based on the local anomaly factor to form first-state time-series data; the data state includes: normal state or abnormal state.

4. The method according to claim 1, characterized in that, The abnormal state data in the time series data to be detected, determined based on the first state time series data and the second state time series data, includes: The data that are in an abnormal state at the same time point in the first state time series data and the second state time series data are identified as the abnormal state data in the time series data to be detected.

5. An anomaly detection device for time-series data, characterized in that, include: The data acquisition module is used to acquire the time series data to be detected; The first detection module is used to input the time series data to be detected into the target local anomaly detection model to obtain the first state time series data; The second detection module is used to input the time series data to be detected into the target anomaly detection network model to obtain the second state time series data. The target anomaly detection network model is a deep learning model based on data reconstruction error. The determination module is used to determine abnormal state data in the time series data to be detected based on the first state time series data and the second state time series data; The training steps of the target local anomaly detection model include: Historical time-series data is acquired, and time-series data samples are obtained by using a time window to extract the historical time-series data. Input the first sample data in the time series data sample into the initial local anomaly detection model to determine the local anomaly factor of the first sample data; Based on the local anomaly factors of the first sample data, abnormal time series data are determined, and the abnormal sample data in the time series data sample is corrected to obtain the updated time series data sample. The time series data sample is updated using the time series data update sample; The time window is cyclically slid with a preset sliding step size, and then the step of using the time window to extract the historical time series data to obtain time series data samples is returned until there are no abnormal sample data in the historical time series data, thus obtaining the target local anomaly detection model. The training steps of the target anomaly detection network model include: The second sample data is input into the initial anomaly detection network model to generate reconstructed data; the second sample data is the sample data contained in the historical time series data finally updated in the training step of the target local anomaly detection model; Determine the loss function values ​​for the reconstructed data and the second sample data; The parameters of the initial anomaly detection network model are adjusted based on the loss function; Return to the step of inputting the second sample data into the initial anomaly detection network model to generate reconstructed data, until the loss function value is less than a preset threshold, and obtain the target anomaly detection network model.

6. The apparatus according to claim 5, characterized in that, The first detection module includes: The data input unit is used to input the data to be detected from the time series data to be detected into the target local anomaly detection model to obtain the local anomaly factor of each data to be detected. A state determination unit is used to determine the data state of each data to be detected based on the local anomaly factor, forming first state time series data; the data state includes: normal state or abnormal state.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the anomaly detection method for time-series data according to any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the anomaly detection method for timing data as described in any one of claims 1-4.

Images