A time series data anomaly monitoring system and method based on LOF and isolation forest

Abstract

The present invention proposes a time series data anomaly monitoring system and method based on LOF and isolation forest, which relates to the field of data processing technology. It includes: a data acquisition module for acquiring time series data; a data preprocessing module for preprocessing time series data; a LOF anomaly score acquisition module for dividing time series data into multiple subsets, adaptively adjusting the window length and K nearest neighbor distance, establishing a LOF model, and calculating the anomaly score LOF. K (p); Isolation forest anomaly score acquisition module, used to establish an isolation forest model, input time series data into the isolation forest model, and calculate the anomaly score s(p,n); fusion module, used to fuse the anomaly score LOF K (p) and anomaly score s(p,n), and obtain the final outlier value based on hierarchical clustering. This paper combines the advantages of Isolation Forest (IFF) for accurate detection of group anomalies and fast execution speed on large batches of data, and the advantages of LOF for high accuracy of single-point anomalies and contextual anomalies. LOF is further improved and has a significant improvement over other algorithms for time-series data.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and in particular relates to a time series data anomaly monitoring system and method based on LOF and isolation forest. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Detecting outliers is crucial in engineering. For time series data like blood pressure and flow, outliers can disrupt the data distribution. Accurately detecting outliers can prevent subsequent catastrophic accidents. Therefore, anomaly detection in time series data is crucial in the field of data mining. The precise definition of outliers varies for common time series data, making existing detection methods unstable for this task.

[0004] Currently, mainstream data anomaly monitoring methods include statistical methods, clustering methods, density-based methods, isolation forest methods, and methods based on the fusion of LOF and isolation forest. The inventors have found that the existing technologies have at least the following shortcomings:

[0005] 1. Statistical methods: These methods calculate the probability of each object by constructing a probability distribution model. Low-probability objects are often considered outliers. However, this method is highly dependent on the choice of model. Different models are suitable for different tasks. If the wrong model is selected, the detection process is likely to result in a high number of misidentified outliers.

[0006] 2. Clustering-based methods: This method clusters data into distinct clusters based on the data's characteristic distribution. Outliers are often located far from the cluster center, but the difficulty lies in selecting the number of clusters. Each clustering model is only suitable for specific data types, and different numbers of clusters produce completely different results.

[0007] 3. Density-based methods: The most representative one is the LOF algorithm. This method determines the density by defining the distance between different points, and then calculates the outlier factor based on the density to reflect the degree of abnormality. This method has high accuracy, but the time complexity is O(N 2 ), it is very inefficient when facing large amounts of data. In addition, when facing group anomalies, the density of the area where the group anomalies are located is high, which causes the score of the anomaly in the area to deviate.

[0008] 4. Isolation Forest-Based Methods: The advantage of the Isolation Forest algorithm is its near-linear time complexity, making it highly effective compared to other methods. It is fast for detecting large amounts of data and is suitable for high-dimensional data. When faced with cluster anomalies, the Isolation Forest algorithm provides relatively reasonable predictions. However, because its segmentation process involves randomly sampling dimensions, this can reduce the accuracy of detection results.

[0009] 5. Isolation Forest Ensemble (LOF)-based Method: Existing fusion methods are mostly simple integration of two detectors. Common integration methods include:

[0010] (1) Using detectors in layers, the algorithm first uses an isolation forest detector to filter out coarse-grained data, and then uses a more reliable LOF detector to filter out more ambiguous anomalies. However, this algorithm does not consider the temporal correlation of the data and performs poorly on temporal data.

[0011] (2) Boosting is used for both detectors, giving the more reliable LOF detector a higher confidence score and the unstable Isolation Forest detector a lower confidence score, and then adding the weighted anomaly scores. However, this algorithm simply performs weighted integration and does not fully utilize the advantages of both detectors. The higher confidence LOF detector still performs poorly when faced with group anomalies.

[0012] In summary, existing data anomaly monitoring methods are often used for data with relatively stable fluctuations, obvious abnormal data, and a large proportion of single-point anomalies. However, when faced with data with more complex abnormal rules and a large number of group and contextual anomalies, existing data anomaly monitoring methods are not stable, and it is difficult to recall a large amount of abnormal data, and accuracy is difficult to guarantee. Summary of the Invention

[0013] In order to overcome the shortcomings of the above-mentioned existing technologies, the present invention provides a time series data anomaly monitoring system and method based on LOF and isolation forest, which effectively combines the advantages of isolation forest in being more accurate in detecting group anomalies and having fast execution speed for large batches of data, and the advantages of LOF in being highly accurate in detecting single-point anomalies and contextual anomalies. On this basis, LOF is further improved, and its performance in anomaly monitoring for time series data, especially tasks such as blood pressure and flow, is good, which is significantly improved compared with other algorithms.

[0014] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0015] A first aspect of the present invention provides a time series data anomaly monitoring system based on LOF and isolation forest.

[0016] A time series data anomaly monitoring system based on LOF and isolation forest, including:

[0017] A data acquisition module, which is used to acquire time series data;

[0018] A data preprocessing module is used to preprocess the time series data to obtain preprocessed time series data;

[0019] The LOF anomaly score acquisition module is used to divide the preprocessed time series data into multiple subsets using windows, use standard deviation to reflect the discrete degree of data in different subsets, adaptively adjust the window length and K nearest neighbor distance, establish the LOF model, and calculate the anomaly score LOF K (p), LOF K (p) sent to the fusion module;

[0020] The isolation forest anomaly score acquisition module is used to build the isolation forest model, input the preprocessed time series data into the isolation forest model, calculate the anomaly score s(p,n), and send s(p,n) to the fusion module;

[0021] Fusion module, which is used to fuse the anomaly score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n) to get the final anomaly value.

[0022] Preferably, the steps of adaptively adjusting the window length and the K nearest neighbor distance by the LOF anomaly score acquisition module include:

[0023] Step 1: Preset the K nearest neighbor distance size and fixed window size;

[0024] Step 2: Split the time series data. Split the first window of the time series data with a fixed window size, and pre-split it backward by the length of the fixed window size to obtain the second window segment.

[0025] Step 3: Calculate the standard deviation of the subset within the second window segment and the standard deviation of the subset within the first window segment;

[0026] Step 4: Determine the size of the standard deviation of the subset within the second window segment and the standard deviation of the subset within the first window segment:

[0027] When the standard deviation of the subset in the second window segment is smaller than the standard deviation of the first window segment, the length of the second window segment is increased, and the size of the K nearest neighbor distance is increased at the same time;

[0028] When the standard deviation of the subset in the second window is greater than the standard deviation of the first window, the length of the second window is reduced, and the size of the K nearest neighbor distance is reduced at the same time;

[0029] Step 5: Repeat steps 1 to 4 until all time series data sets are segmented.

[0030] Preferably, when the standard deviation of the subset in the current window is smaller than the standard deviation of the previous window, it means that the fluctuation of the time series data in the current window is small, the probability of outliers appearing is correspondingly reduced, and a larger neighborhood distance is used to measure the density within the neighborhood; when the standard deviation of the subset in the current window is larger than the standard deviation of the previous window, it means that the fluctuation of the time series data in the current window is large, the probability of outliers appearing is correspondingly increased, and a smaller neighborhood distance is used to measure the density within the neighborhood.

[0031] Preferably, the window length and K nearest neighbor distance are expressed as:

[0032] The expression for window length is:

[0033] The expression of K nearest neighbor distance is:

[0034] Among them, K_g is the preset K nearest neighbor distance; W_g is the preset fixed window size; Q represents the dimension; std i,j is the standard deviation of the time series data in the current window; std i+1,j is the standard deviation of the time series data in the next window.

[0035] Preferably, the standard deviation calculation formula is:

[0036]

[0037] Among them, W is the length of the current window, x t is a sample point in the subset, i∈m, E(s i ) is the mean of the subset in the window.

[0038] Preferably, the LOF anomaly score acquisition module is used to establish a LOF model and calculate the anomaly score LOF K The specific steps of (p) are:

[0039] Set points p and o to the i-th subset s i Point in, o is the Kth point closest to point p, and o∈s i ,but:

[0040] Step 1. Calculate the window length W;

[0041] Step 2. Calculate the K nearest neighbor distance K;

[0042] Step 3. Calculate the Euclidean distance between points p and o

[0043] Step 4. Calculate the K nearest neighbor distance d K(p) = d(p,o);

[0044] Step 5. Find K distance neighbors N K (p)={d(p,o 1 )≤d(p,o)}, where o 1 is the set of all points with p as the center and less than K nearest neighbor distances;

[0045] Step 6. Calculate the reachable distance d between points p and o K (p,o)=max{d K (p),d(p,o)};

[0046] Step 7. Calculate the local reachability density of points p and o

[0047] Step 8. Calculate the local outlier factors of points p and o Obtained LOF K (p) is the outlier value of sample point p.

[0048] Preferably, the isolation forest anomaly score acquisition module is used to establish an isolation forest model, and the specific steps of calculating the anomaly score s(p,n) are:

[0049] Step 1: Extract samples from time series data, randomly select features of a certain dimension, and build a decision tree;

[0050] Step 2: Calculate the distance h(p) from the sample point to the root and the average value E(h(p)) of h(p);

[0051] Step 3: Calculate the average path length l(n) of the decision tree;

[0052] Step 4: Calculate the anomaly score of sample point p based on the average path length l(n) and the average value E(h(p)) of h(p);

[0053] Step 5: Extract samples and features multiple times, build multiple decision trees, and repeat the process from step 1 to step 4 to obtain the anomaly score s(p,n) of the isolation forest model.

[0054] The fusion module is used to fuse the anomaly score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n), the specific steps to obtain the final anomaly value are:

[0055] The anomaly score LOF K (p) and abnormal score s(p,n) are normalized and standardized;

[0056] Use hierarchical clustering to cluster the data under each window and calculate the distance between clusters;

[0057] Set the cluster distance threshold;

[0058] If the inter-cluster distance is greater than the cluster distance threshold and the amount of data in each cluster is greater than or equal to 2, the confidence of the isolation forest detector is increased; otherwise, the confidence of the LOF detector is increased.

[0059] Preferably, data with a value greater than a cluster distance threshold is screened as abnormal data.

[0060] The second aspect of the present invention provides a time series data anomaly monitoring method based on LOF and isolation forest.

[0061] A time series data anomaly monitoring method based on LOF and isolation forest includes the following steps:

[0062] Obtain time series data and preprocess the time series data;

[0063] The preprocessed time series data is divided into multiple subsets using windows, and the standard deviation is used to reflect the discrete degree of data in different subsets. The window length and K nearest neighbor distance are adaptively adjusted to establish the LOF model and calculate the anomaly score LOF. K (p);

[0064] Establish an isolation forest model, input the preprocessed time series data into the isolation forest model, and calculate the anomaly score s(p,n);

[0065] Fusion Anomaly Score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n) to get the final anomaly value.

[0066] One or more of the above technical solutions have the following beneficial effects:

[0067] The present invention effectively combines the isolation forest and improved LOF algorithms, effectively combining the advantages of the isolation forest being more accurate in detecting group anomalies and having fast execution speed for large batches of data, and the LOF being highly accurate in detecting single-point anomalies and contextual anomalies. On this basis, the LOF is further improved, and performs well in detecting anomalies in time series data, especially tasks such as blood pressure and flow. Compared with other algorithms, it has a significant improvement in precision, accuracy and speed.

[0068] The present invention further improves LOF. The improved LOF detector effectively improves the accuracy of the LOF algorithm by dynamically sliding the window and adaptively adjusting the K nearest neighbor distance.

[0069] The present invention adds hierarchical clustering to the fusion module to identify continuous anomaly features, thereby solving the problem that the simple weighted ensemble detector method performs poorly in detecting continuous anomalies.

[0070] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0072] Figure 1 This is a system structure diagram of the first embodiment.

[0073] Figure 2 Schematic diagram of different anomaly types of time series data.

[0074] Figure 3 This is a schematic diagram of the dynamic adjustment of the window size in the improved LOF algorithm of the first embodiment and the super-parameter K-neighborhood distance in the LOF detector.

[0075] Figure 4 This is the P / R curve of different algorithms on the test set.

[0076] Figure 5 P / R curves under different adaptive fusion strategies.

[0077] Figure 6 This is a flow chart of the method of the second embodiment. DETAILED DESCRIPTION

[0078] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0079] It should be noted that the terms used herein are for describing particular embodiments only and are not intended to limit the exemplary embodiments according to the present invention.

[0080] In the absence of conflict, the embodiments of the present invention and the features thereof may be combined with each other.

[0081] The overall idea proposed by the present invention is:

[0082] like Figure 2As shown in Figure 2, for low-dimensional time series data, the distribution of anomaly data can be broadly summarized into the following three types: 1. Single-point anomalies 2. Group anomalies 3. Contextual anomalies. Furthermore, specific anomaly detection rules can reveal different anomaly forms. Existing anomaly detection methods are often targeted at data with relatively stable fluctuations, obvious anomalies, and a large proportion of single-point anomalies. However, they are less reliable for data with complex anomaly rules and a large number of group and contextual anomalies, making it difficult to recall large amounts of anomaly data.

[0083] This paper effectively combines the Isolation Forest and Improved LOF algorithms by adding hierarchical clustering to the fusion module to identify cluster anomaly characteristics. This solves the problem of the simple weighted ensemble detector method's poor performance in detecting cluster anomalies. The improved LOF detector also effectively improves the algorithm's accuracy through a dynamic sliding window and adaptive adjustment of the K-nearest neighbor distance.

[0084] This method effectively combines the advantages of Isolation Forest (IFF) for group anomalies and its fast execution speed for large batches of data with the high accuracy of LOF for single-point anomalies and contextual anomalies. On this basis, LOF is further improved and performs well in anomaly detection for time series data, especially tasks such as blood pressure and flow, with significant improvements compared to other algorithms.

[0085] Example 1

[0086] This embodiment discloses a time series data anomaly monitoring system based on LOF and isolation forest.

[0087] like Figure 1-5 As shown in FIG, a time series data anomaly monitoring system based on LOF and isolation forest includes:

[0088] A data acquisition module, which is used to acquire time series data;

[0089] A data preprocessing module is used to preprocess the time series data to obtain preprocessed time series data;

[0090] The LOF anomaly score acquisition module is used to divide the preprocessed time series data into multiple subsets using windows, use standard deviation to reflect the discrete degree of data in different subsets, adaptively adjust the window length and K nearest neighbor distance, establish the LOF model, and calculate the anomaly score LOF K (p), LOF K (p) sent to the fusion module;

[0091] The isolation forest anomaly score acquisition module is used to build the isolation forest model, input the preprocessed time series data into the isolation forest model, calculate the anomaly score s(p,n), and send s(p,n) to the fusion module;

[0092] Fusion module, which is used to fuse the anomaly score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n) to get the final anomaly value.

[0093] The data preprocessing module preprocesses the time series data to obtain preprocessed time series data, specifically:

[0094] Delete more than 30 consecutive data with the same value (this data segment can be considered invalid);

[0095] Perform linear interpolation to fill the empty values.

[0096] (1) Improved LOF algorithm

[0097] The present invention accelerates the running speed by dividing the data of the input model into subsets; and uses the standard deviation to reflect the discrete degree of data in different subsets, and adaptively adjusts the window length of the divided subsets and the size of the K nearest neighbor distance, thereby improving the accuracy.

[0098] The first segment uses a fixed window size to segment the data set and then pre-segments the fixed window size backward. When the standard deviation of the subset within the window is smaller than that of the previous window, the window length is increased, indicating that the time series data within this window has less fluctuation and the probability of outliers is correspondingly reduced. At the same time, the K-nearest neighbor distance is increased, and a larger neighborhood distance is used to measure the density within the neighborhood. When the standard deviation of the subset within the window is larger than that of the previous window, the window length is decreased, indicating that the time series data within this window has more fluctuation and the probability of outliers is correspondingly increased. At the same time, the K-nearest neighbor distance is decreased, and a smaller neighborhood distance is used to measure the density within the neighborhood.

[0099] The data in each window is given an initial K nearest neighbor distance K_g and a fixed window size W_g. The adaptive window randomly divides the original blood pressure sample S containing n samples into a set of m samples, {s1,s2,......s m}∈S, the mean of the subset in the window is E(s i ).

[0100] Calculating standard deviation Among them, W is the length of the current window, x t is a sample point in the subset, i∈m.

[0101] Calculate the standard deviation std of the time series data in the current window i , the length of the pre-sliding window W_g to the next subset to calculate the standard deviation std of the next window i+1, update the window length and K nearest neighbor distance size, after determining the window length and K nearest neighbor distance, use the Euclidean distance to calculate the distance between samples, and take the i-th subset s i Take points p and o in as examples, o is the Kth point closest to point p, and o∈s i , the process is as follows:

[0102] 1. The expression of window length is

[0103] 2. The expression of K nearest neighbor distance is Where Q represents the dimension.

[0104] 3. Calculate Euclidean distance

[0105] 4. Calculate the K nearest neighbor distance d K (p)=d(p,o).

[0106] 5. Find K distance neighborhood N K (p)={d(p,o 1 )≤d(p,o)}, where o 1 is the set of all points with p as the center and less than K nearest neighbor distances.

[0107] 6. Calculate the reachable distance d K (p,o)=max{d K (p),d(p,o)}.

[0108] 7. Calculate local reachability density

[0109] 8. Calculate the local outlier factor

[0110] Thus, the outlier factor of each sample point is obtained to judge the abnormal point, and the final output LOF K (p) is the outlier value of sample point p.

[0111] (2) Isolation Forest Algorithm

[0112] The Isolation Forest algorithm extracts samples from raw time series data, randomly selects features from a certain dimension, and constructs a decision tree. Using ensemble learning, it extracts samples and features repeatedly to construct multiple decision trees, thereby detecting abnormal data. Abnormal samples are closer to the root node in the decision tree, while normal samples fall on leaf nodes farther from the root. The Isolation Forest algorithm calculates the outlier value based on the distance from the leaf node to the root node, thereby identifying anomalies.

[0113] The number of edges from the sample point p to the root is h(p), which is the distance from the sample point to the root. Given a data set containing n samples, the calculation process of the isolation forest algorithm is as follows:

[0114] 1. Calculate the average path length of the decision tree

[0115] 2.H(n-1)=ln(n-1)+ξ, where ξ is Euler's constant, which is approximately 0.58.

[0116] 3. Calculate the outlier score of sample point p Where E(h(p)) is the average value of h(p) of sample p in the forest.

[0117] Output the outlier value s(p,n) given by the isolation forest, and further compare it with the LOF given by LOF K (p) Fusion to obtain the final anomaly score of the sample.

[0118] (3) Fusion of Isolation Forest and Improved LOF Outliers

[0119] Note the anomaly score source of the sample point p obtained by the two detectors iForest (p) and source lof (p), normalize them to the space under the same distribution, and record them as mean iForest 、std iForest 、mean lof 、std lof , are the mean and standard deviation of the scores obtained in each score respectively.

[0120] Use hierarchical clustering to cluster the data in this window and set the cluster distance threshold Threshold cluster If the cluster distance is greater than the threshold and the amount of data in each cluster is greater than or equal to 2, it is considered that a continuous anomaly may occur, and the confidence of the isolation forest detector is increased in the data within this window. Conversely, it is considered that a discontinuous anomaly may occur, and the confidence of the LOF detector is increased in the data within this window.

[0121] Finally, the data with a value greater than the threshold value is filtered as abnormal data.

[0122] The fusion process is as follows:

[0123] 1. Normalized Isolation Forest Score

[0124] 2. Standardized l of score

[0125] 3. Calculate inter-cluster distance

[0126] 4. If dist(C i ,C j )≥Threshold cluster And Count(C i )≥2,Count(C j )≥2(C i ∈Cluster k ,C j ∈Cluster k+1 ,k≥2), then increase β, otherwise increase α

[0127] 5. Fusion

[0128]

[0129] The following is a verification experiment of the method described in the present invention.

[0130] Obtain a low-dimensional time series related data set, and make P / R curves and evaluation indicators on the time series data of the Queensland Vital Signs Dataset (referred to as the time series data set) and the Yahoo WebScope data set (extracting 2 real distribution data and 2 artificially synthesized data, see LOF+IF_Cmerge in Table 1). Figure 4 As shown in Table 1 and Table 2, our method ( Figure 4 ,LOF+I F_Cmerge) in Table 1 and Table 2 has a better effect.

[0131] Table 1: Average precision of different algorithms on the Yahoo WebScope test set

[0132]

[0133] Table 2: Recall rate and algorithm evaluation indicators of detectors under different anomaly types on time series datasets

[0134]

[0135] like Figure 5 As shown in the figure, the weight fusion method can also be adopted after cluster identification, and then the dynamic adjustment weight strategy is applied for fusion, but the effect is not as good as fixed parameter adjustment. It can be considered that fixed parameter adjustment is formulated for specific anomaly detection rules, so it performs better.

[0136] Example 2

[0137] This embodiment provides a time series data anomaly monitoring method based on LOF and isolation forest.

[0138] like Figure 6As shown in FIG, a time series data anomaly monitoring method based on LOF and isolation forest includes the following steps:

[0139] Obtain time series data and preprocess the time series data;

[0140] The preprocessed time series data is divided into multiple subsets using windows, and the standard deviation is used to reflect the discrete degree of data in different subsets. The window length and K nearest neighbor distance are adaptively adjusted to establish the LOF model and calculate the anomaly score LOF. K (p);

[0141] Establish an isolation forest model, input the preprocessed time series data into the isolation forest model, and calculate the anomaly score s(p,n);

[0142] Fusion Anomaly Score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n) to get the final anomaly value.

[0143] Those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computer device. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. Alternatively, they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0144] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.

Claims

1. A time series data anomaly monitoring system based on LOF and isolation forest, characterized by: include: A data acquisition module, which is used to acquire time series data; A data preprocessing module is used to preprocess the time series data to obtain preprocessed time series data; The LOF anomaly score acquisition module is used to divide the preprocessed time series data into multiple subsets using windows, use standard deviation to reflect the discrete degree of data in different subsets, adaptively adjust the window length and K nearest neighbor distance, establish the LOF model, and calculate the anomaly score LOF K (p), LOF K (p) sent to the fusion module; The isolation forest anomaly score acquisition module is used to build the isolation forest model, input the preprocessed time series data into the isolation forest model, calculate the anomaly score s(p,n), and send s(p,n) to the fusion module; Fusion module, which is used to fuse the anomaly score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n) to get the final anomaly value.

2. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 1, characterized in that: The steps for adaptively adjusting the window length and K-nearest neighbor distance in the LOF anomaly score acquisition module include: Step 1: Preset the K nearest neighbor distance size and fixed window size; Step 2: Split the time series data. Split the first window of the time series data with a fixed window size, and pre-split it backward by the length of the fixed window size to obtain the second window segment. Step 3: Calculate the standard deviation of the subset within the second window segment and the standard deviation of the subset within the first window segment; Step 4: Determine the size of the standard deviation of the subset within the second window segment and the standard deviation of the subset within the first window segment: When the standard deviation of the subset in the second window segment is smaller than the standard deviation of the first window segment, the length of the second window segment is increased, and the size of the K nearest neighbor distance is increased at the same time; When the standard deviation of the subset in the second window is greater than the standard deviation of the first window, the length of the second window is reduced, and the size of the K nearest neighbor distance is reduced at the same time; Step 5: Repeat steps 1 to 4 until all time series data sets are segmented.

3. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 2, characterized in that: When the standard deviation of the subset in the current window is smaller than that of the previous window, it indicates that the fluctuation of the time series data in the current window is small, the probability of outliers appearing is correspondingly reduced, and a larger neighborhood distance is used to measure the density within the neighborhood; when the standard deviation of the subset in the current window is larger than that of the previous window, it indicates that the fluctuation of the time series data in the current window is large, the probability of outliers appearing is correspondingly increased, and a smaller neighborhood distance is used to measure the density within the neighborhood.

4. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 2, characterized in that: The window length and K nearest neighbor distance are expressed as: The expression for window length is: The expression of K nearest neighbor distance is: Among them, K_g is the preset K nearest neighbor distance; W_g is the preset fixed window size; Q represents the dimension; std i,j is the standard deviation of the time series data in the current window; std i+1,j is the standard deviation of the time series data in the next window.

5. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 2, characterized in that: The formula for calculating standard deviation is: Among them, W is the length of the current window, x t is a sample point in the subset, i∈m, E(s i ) is the mean of the subset in the window.

6. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 4, characterized in that: The LOF anomaly score acquisition module is used to establish the LOF model and calculate the anomaly score LOF K The specific steps of (p) are: Set points p and o to the i-th subset s i Point in, o is the Kth point closest to point p, and o∈s i ,but: Step 1. Calculate the window length W; Step 2. Calculate the K nearest neighbor distance K; Step 3. Calculate the Euclidean distance between points p and o Where Q is the different dimensions of the point, which are extracted from {1,2…n} dimensions for calculation; Step 4. Calculate the K nearest neighbor distance d K (p) = d(p,o); Step 5. Find K distance neighbors N K (p)={d(p,o 1 )≤d(p,o)}, where o 1 is the set of all points with p as the center and less than K nearest neighbor distances; Step 6. Calculate the reachable distance d between points p and o K (p,o)=max{d K (p),d(p,o)}; Step 7. Calculate the local reachability density of points p and o Step 8. Calculate the local outlier factors of points p and o Obtained LOF K (p) is the outlier value of sample point p.

7. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 1, characterized in that: The isolation forest anomaly score acquisition module is used to establish the isolation forest model. The specific steps for calculating the anomaly score s(p,n) are as follows: Step 1: Extract samples from time series data, randomly select features of a certain dimension, and build a decision tree; Step 2: Calculate the distance h(p) from the sample point to the root and the average value E(h(p)) of h(p); Step 3: Calculate the average path length l(n) of the decision tree; Step 4: Calculate the anomaly score of sample point p based on the average path length l(n) and the average value E(h(p)) of h(p); Step 5: Extract samples and features multiple times, build multiple decision trees, and repeat the process from step 1 to step 4 to obtain the anomaly score s(p,n) of the isolation forest model.

8. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 1, characterized in that: The fusion module is used to fuse the anomaly score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n), the specific steps to obtain the final anomaly value are: The anomaly score LOF K (p) and abnormal score s(p,n) are normalized and standardized; Use hierarchical clustering to cluster the data under each window and calculate the distance between clusters; Set the cluster distance threshold; If the inter-cluster distance is greater than the cluster distance threshold and the amount of data in each cluster is greater than or equal to 2, the confidence of the isolation forest detector is increased; otherwise, the confidence of the LOF detector is increased.

9. The time series data anomaly monitoring system based on LOF and isolation forest according to claim 8, characterized in that: Data with a value greater than the cluster distance threshold is filtered as abnormal data.

10. A method for monitoring anomalies in time series data based on LOF and isolation forest, characterized by: The following steps are involved: Obtain time series data and preprocess the time series data; The preprocessed time series data is divided into multiple subsets using windows, and the standard deviation is used to reflect the discrete degree of data in different subsets. The window length and K nearest neighbor distance are adaptively adjusted to establish the LOF model and calculate the anomaly score LOF. K (p); Establish an isolation forest model, input the preprocessed time series data into the isolation forest model, and calculate the anomaly score s(p,n); Fusion Anomaly Score LOF K (p) and anomaly score s(p,n), based on hierarchical clustering, adjust the anomaly score LOF K (p) and the confidence of the anomaly score s(p,n) to get the final anomaly value.

Images