A time series data anomaly detection method, device, equipment and storage medium

Abstract

The application discloses a time series data anomaly detection method, device and equipment and a storage medium, and is applied to the field of time series data anomaly detection, wherein the method comprises the following steps: acquiring time series data; inputting the time series data into a multi-scale feature coding network to obtain multi-scale data coding features; inputting the multi-scale data coding features into a multi-scale local memory module to obtain multi-scale local memory features; determining a first distance according to the multi-scale local memory features; and when the first distance is greater than a threshold value, the time series data is abnormal. Through feature learning and constraint of the multi-scale local memory module, the application can improve the feature learning capability, increase the generalization capability of the model, effectively avoid the abnormal data overfitting problem caused by training data noise, improve the discrimination degree between abnormal features and normal features, and further improve the detection accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of time series data anomaly detection, and in particular to a time series data anomaly detection method, device, equipment and storage medium. BACKGROUND

[0002] Time series data anomaly detection is one of the most mature applications of time series data analysis, and is a process of identifying abnormal events or behaviors from normal time series. Effective anomaly detection is widely used in many fields of the real world, such as quantitative trading, network security detection, autonomous driving cars and routine maintenance of large industrial equipment. Generally speaking, many anomalies can be judged by artificial means. However, when the business combination is complex and the time series scale becomes large, it is difficult to rely on traditional artificial and simple absolute value algorithms such as same period and same base to judge. Therefore, when facing various industrial scenarios, an automated time series anomaly detection method based on machine learning is particularly important.

[0003] Based on traditional machine learning methods, such as statistical models, multivariate normal distribution models, independent forest methods, etc., obvious abnormal points can be detected to a certain extent, but they are sensitive to data noise and only model each time series data independently, making it difficult to solve the anomalies caused by the mutual correlation of multi-dimensional time series data. The time series data in the actual scene has the characteristics of large noise, large fluctuation, concept drift, etc., and the traditional machine learning method is difficult to meet the needs of complex scenarios.

[0004] In recent years, methods based on deep learning have been gradually applied to time series data anomaly detection. For example, recurrent neural networks, methods based on convolutional neural networks (CNN) and attention networks (Attention Net) cannot solve the problem of noise in training data (i.e. no labeled abnormal data), and the model can fit the abnormal data to a certain extent, resulting in poor reconstruction error differentiation; due to the lack of training data scale and diversity, overfitting problem is easy to occur, which ultimately leads to poor time series data anomaly detection effect. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a time series data anomaly detection method, device, equipment and storage medium, which solves the problem of inaccurate time series data anomaly detection in the related art.

[0006] To solve the above technical problems, the present application provides a time series data anomaly detection method, comprising:

[0007] obtaining time series data;

[0008] input the time series data into a multi-scale feature encoding network to obtain multi-scale data encoding features;

[0009] input the multi-scale data encoding features into a multi-scale local memory module to obtain multi-scale local memory features;

[0010] determine a first distance according to the multi-scale local memory features;

[0011] when the first distance is greater than a threshold value, the time series data is abnormal.

[0012] Optionally, the determining a first distance according to the multi-scale local memory features comprises:

[0013] calculating distances between the multi-scale local memory features and feature vectors in a global memory queue corresponding to the scale as second distances;

[0014] taking a feature vector corresponding to a minimum distance in the second distances as a global memory feature;

[0015] calculating distances between the multi-scale local memory features and the global memory feature as third distances;

[0016] weighting and averaging the third distances to obtain a multi-scale memory distance, and taking the multi-scale memory distance as the first distance.

[0017] Optionally, after the taking the multi-scale memory distance as the first distance, the method further comprises:

[0018] when the first distance is less than the threshold value, the time series data is normal, and the multi-scale local memory features are updated into the global memory queue corresponding to the scale.

[0019] Optionally, a loss function in a training process of the multi-scale local memory module comprises:

[0020] taking a total loss function calculated according to addition of a sparse loss function and a mapping loss function as the loss function.

[0021] Optionally, the obtaining time series data comprises:

[0022] obtaining initial time series data;

[0023] normalizing the initial time series data to obtain normalized data;

[0024] performing a preprocessing operation on the normalized data through one-dimensional convolution to obtain preprocessed data, and taking the preprocessed data as the time series data.

[0025] Optionally, the preprocessing operation on the normalized data by one-dimensional convolution comprises:

[0026] The one-dimensional convolution parameters comprise a convolution step and a convolution kernel size.

[0027] The one-dimensional convolution operation is performed on the normalized data according to the one-dimensional convolution parameters, and the preprocessing data is obtained.

[0028] The present application further provides a time series data anomaly detection device, comprising:

[0029] The acquisition module is configured to acquire time series data.

[0030] The multi-scale data encoding feature extraction module is configured to input the time series data into a multi-scale feature encoding network to obtain multi-scale data encoding features.

[0031] The multi-scale local memory feature extraction module is configured to input the multi-scale data encoding features into a multi-scale local memory module to obtain multi-scale local memory features.

[0032] The first distance determination module is configured to determine a first distance according to the multi-scale local memory features.

[0033] The data anomaly determination module is configured to determine that the time series data is abnormal when the first distance is greater than a threshold.

[0034] Optionally, the first distance determination module comprises:

[0035] The first calculation unit is configured to calculate a distance between the multi-scale local memory features and a feature vector in a global memory queue corresponding to a scale as a second distance.

[0036] The global memory feature determination unit is configured to take a feature vector corresponding to a minimum distance in the second distance as a global memory feature.

[0037] The second calculation unit is configured to calculate a distance between the multi-scale local memory features and the global memory feature as a third distance.

[0038] The multi-scale memory distance determination unit is configured to obtain a multi-scale memory distance by weighting and averaging the third distance, and take the multi-scale memory distance as the first distance.

[0039] The present application further provides a time series data anomaly detection device, comprising:

[0040] The memory is configured to store a computer program.

[0041] A processor is configured to implement the steps of the time series data anomaly detection method when executing the computer program.

[0042] The application further provides a storage medium, wherein the storage medium stores a computer program, and the computer program is configured to implement the steps of the time series data anomaly detection method when executed by a processor.

[0043] It can be seen that, by using the multi-scale feature coding network to perform multi-scale feature extraction and using the multi-scale local memory module to perform feature learning and constraint, the ability of feature learning can be improved, the generalization ability of the model is increased, the problem of abnormal data overfitting caused by noise of training data can be effectively avoided, the discrimination between abnormal features and normal features is improved, and thus the detection accuracy can be improved.

[0044] In addition, the application further provides a time series data anomaly detection device, equipment and a storage medium, which also have the beneficial effects described above. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only embodiments of the application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0046] Figure 1 A flow chart of the time series data anomaly detection based on the recurrent neural network is provided for the embodiment;

[0047] Figure 2 A flow chart of the time series data anomaly detection is provided for the embodiment of the application;

[0048] Figure 3 A flow chart of the time series data anomaly detection training network is provided for the embodiment of the application;

[0049] Figure 4 A structure diagram of the time series data anomaly detection training network is provided for the embodiment of the application;

[0050] Figure 5 A structure diagram of the local memory module network is provided for the embodiment of the application;

[0051] Figure 6 A structure diagram of the time series data anomaly detection is provided for the embodiment of the application;

[0052] Figure 7 A structure diagram of the time series data anomaly detection device is provided for the embodiment of the application;

[0053] Figure 8 A structural schematic diagram of a time series data anomaly detection device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0054] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in a clear and complete manner with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0055] Deep learning is applied to the field of time series data anomaly detection, and a commonly used deep learning method is a recurrent neural network. Based on sequence encoding of the recurrent neural network, a method combining prediction, reconstruction or data distribution distance is used to locate an anomaly point. The recurrent neural network (RNN) has a natural advantage in processing time series, but its disadvantage is also obvious, that is, it can only process sequentially and cannot perform parallel computation, and thus the training and inference speed is slow. A method based on the recurrent neural network and sequence reconstruction uses LSTM (Long short-term memory) as feature encoding and decoding, and VAE (Variational auto-encoder) as a feature encoding and decoding architecture, which is a method based on the recurrent neural network and uses reconstruction error as an anomaly measurement. Figure 1 A time series data anomaly detection flowchart based on the recurrent neural network provided for the embodiment is mainly a reasoning process: 1) data preprocessing, 2) inputting an image to a trained encoder network (Encoder) for feature extraction and encoding, 3) inputting the encoded features to a decoder (Decoder) for decoding to reconstruct a signal at a certain time, and 4) determining whether it is an anomaly point by a threshold judgment method. The method uses a typical recurrent neural network LSTM for encoding and decoding. Due to the serial computation characteristics of the recurrent neural network, the model training and inference speed is slow, and the method does not consider the noise problem existing in the training data, which will interfere with the reconstruction error and further affect the detection effect, and thus there is still a large space for improvement and promotion of anomaly detection.

[0056] Deep learning methods also have methods based on convolutional neural networks (CNN, Convolutional Neural Network) and attention networks (Attention Net), which have the advantage of parallel computing, and can also be used to solve time series data anomaly detection problems through optimization and improvement of characteristics. But it can't solve the problem that the model can fit the abnormal data to a certain extent due to the existence of noise in the training data (i.e. no labeled abnormal data), resulting in poor reconstruction error differentiation.

[0057] The present application provides a time series data anomaly detection method, which extracts multi-scale features through a multi-scale feature encoding network, and learns and constrains features through a multi-scale local memory module to avoid overfitting and improve the accuracy and stability of anomaly detection. Please refer to Figure 2 , Figure 2 A flowchart of a time series data anomaly detection method is provided for the embodiments of the present application. The method can include:

[0058] S101: Obtain time series data.

[0059] The execution subject of the present embodiment is a processor. The present embodiment does not limit the size of the obtained time series data. The present embodiment does not limit the time series data. For example, it can be directly obtained from the time series data to be detected; or it can also be the time series data obtained by preprocessing the time series data to be detected.

[0060] Further, in order to smooth the time series data and facilitate subsequent processing, the above-mentioned obtaining time series data can include the following steps:

[0061] Step 51, obtain initial time series data.

[0062] Step 52, normalize the initial time series data to obtain normalized data.

[0063] Step 53, pre-process the normalized data by one-dimensional convolution to obtain pre-processed data, and use the pre-processed data as time series data.

[0064] Collect a segment of initial time series data (d*w, d is the number of signals, and w is the size of the time window), normalize it, and pre-process it by one-dimensional convolution. The present embodiment does not limit the setting parameters of the pre-processing, for example, the convolution step parameter can be set; or the convolution kernel size parameter can also be set.

[0065] Further, in order to effectively process each data point, the above-mentioned one-dimensional convolution pre-processes the normalized data to obtain pre-processed data, which can include the following steps:

[0066] Step 71, setting a one-dimensional convolution parameter, the one-dimensional convolution parameter including: a convolution step and a convolution kernel size.

[0067] Step 72, performing a one-dimensional convolution operation on the normalized data according to the one-dimensional convolution parameter to obtain preprocessed data.

[0068] The convolution step and the convolution kernel size parameter are set, and a one-dimensional convolution operation is performed according to the set parameters to obtain preprocessed data. The embodiment does not limit the specific values of the parameters. For example, the convolution step can be 1; or it can also be 2. The convolution kernel can be 3, or it can also be 5. Further, in order to achieve better preprocessing effect, the convolution step can be set to 1, and the convolution kernel size can be set to any one of 3, 5 and 7. After the setting is completed, a one-dimensional convolution operation is performed on the normalized data in the time direction according to the set parameters to obtain preprocessed data.

[0069] S102: inputting the time series data into the multi-scale feature encoding network to obtain multi-scale data encoding features.

[0070] The embodiment extracts and represents features of the data at different scales. Specifically, a multi-level encoding module can be constructed, each level of the encoding module can encode features of one scale, and the time series dimension W n n-1 of the nth level of the encoding module is 1 / 2W

[0071] The multi-scale encoding network is a deep neural network composed of multiple encoding modules, and the input of each encoding module is obtained by down-sampling operation from the output of the previous encoding module. The embodiment does not limit the encoding module. For example, the encoding module can be a fully connected network; or the encoding module can also be a convolutional neural network; or the encoding module can also be a recurrent neural network; or the encoding module can also be an attention network. The decoding module is similar to the encoding module, and is also multi-scale, and two adjacent decoding modules are connected by an up-sampling layer. The embodiment does not limit the implementation method of the down-sampling operation. For example, the down-sampling operation can be realized by using a conventional Max-pooling (maximum pooling) operation; or the down-sampling operation can also be realized by using one-dimensional convolution. The embodiment does not limit the implementation method of the up-sampling operation. For example, the up-sampling operation can be realized by using interpolation; or the up-sampling operation can also be realized by using one-dimensional convolution; or the up-sampling operation can also be realized by using a hollow convolution.

[0072] S103: inputting the multi-scale data encoding features into the multi-scale local memory module to obtain multi-scale local memory features.

[0073] ​The multi-scale local memory module is composed of multiple scales of learnable memory modules, and each module corresponds to a scale of the encoding network. That is, for an encoding network composed of N scales, there are N encoding modules, and the output of each encoding module is used for downsampling on one hand and entering the local memory module corresponding to the scale on the other hand. Assuming that the memory unit number of the local memory module M i corresponding to scale i is K, the size of the local memory module of this scale is (K*C), that is, composed of K vectors with a size of C. When performing local memory module feature constraint, assuming that the output of the encoding module corresponding to scale i is E i , first calculate the distance between E i and each vector of the local memory module M i , construct a distance matrix and obtain a distance score matrix S i through a softmax operation (softmax is a binary classification function), and then calculate the matrix multiplication of S i and M i to obtain the local memory feature P i . The feature representation method based on the multi-scale local memory module of the embodiment reduces the interference of abnormal samples on normal feature learning, thereby increasing the discrimination between normal samples and abnormal samples.

[0074] Further, in order to improve the detection accuracy of abnormal time series data, the loss function in the training process of the multi-scale local memory module can include the following steps:

[0075] The total loss function calculated by adding the sparse loss function and the mapping loss function is used as the loss function.

[0076] The sparse loss function is used to constrain the sparsity of the memory module, thereby reducing the reconstruction ability of the abnormal samples; the mapping loss function is used to constrain the difference between the input and output of the memory module, so as to ensure that the memory module does not have a large amplitude change on the feature. When calculating the reconstruction error, the sum of the three loss functions (sparse loss function, mapping loss function, and mean square error function) is required. Among them, the sparse loss function and the mapping loss function are calculated first, and then added respectively to obtain the total sparse loss function and the total mapping loss function as the sparse loss function and the mapping loss function used for calculating the reconstruction error. (For example, the sparse loss function and the mapping loss function of the local memory module corresponding to scale i are and The total loss sparse loss function is The total mapping loss is ). The mean square error function is calculated using the scale 1 decoding features. During training, the three parts of the loss function are directly added together, and then backpropagation is performed to update the model weights. The model here is a time series anomaly detection training network model, including a multi-scale memory module, a multi-scale encoding network, and a multi-scale decoding network.

[0077] The method for updating the weights in this embodiment can include, but is not limited to, SGD (Stochastic Gradient Descent), RMSprop (Root Mean Square Prop), Adam (Adaptive Moment Estimation), NAG (Nesterov Accelerated Gradient), or a combination thereof. The present embodiment does not limit the termination condition for updating the weights. For example, the termination condition can be that the number of optimizations reaches the total number of optimizations; the termination condition can also be that the loss value is less than a certain preset value. The model training is performed in an end-to-end unsupervised training manner, and the different stages and branches of the model are trained, updated, and ended simultaneously.

[0078] In the training process of the multi-scale local memory module, the sparse loss function is used to constrain the sparsity of the memory module, thereby reducing the reconstruction ability of the abnormal samples; the mapping loss function is used to constrain the difference between the input and output of the memory module, thereby ensuring that the memory module does not make large changes to the features, and improving the detection accuracy of abnormal time series data.

[0079] S104: Determine the first distance according to the multi-scale local memory features.

[0080] The present embodiment does not limit the specific method for determining the first distance by the multi-scale local memory features; for example, a multi-scale feature decoding network can be used to calculate the first distance according to the reconstruction result obtained by the decoding network and the original input time series data; or the comprehensive feature distance can be calculated by comparing the multi-scale local memory features with the distance of the global memory queue memory unit, and then the comprehensive feature distance is taken as the first distance.

[0081] The time series in the real world mainly come from various systems, sensors, and other devices, and concept drift is inevitable. Machine learning and deep learning assume that the training and testing data satisfy the independent and identically distributed assumption. Therefore, when concept drift occurs, the performance of the model will decrease significantly. Existing methods rarely consider this problem, resulting in good theoretical results but poor practical application results. The time series anomaly detection method based on recurrent neural networks cannot well cope with the occurrence of concept drift.

[0082] Further, in order to avoid the problem of abnormal detection accuracy decline caused by concept drift of time series data, the first distance determined by the multi-scale local memory feature can include the following steps:

[0083] Step 21, calculate the distance between the multi-scale local memory feature and the feature vector in the global memory queue of the corresponding scale as the second distance.

[0084] Step 22, the feature vector corresponding to the minimum distance in the second distance is taken as the global memory feature.

[0085] Step 23, calculate the distance between the multi-scale local memory feature and the global memory feature as the third distance.

[0086] Step 24, the third distance is weighted and averaged to obtain the multi-scale memory distance, and the multi-scale memory distance is taken as the first distance.

[0087] The embodiment can compare the multi-scale local memory feature vector with the vector group in the global memory queue of the corresponding scale, find the nearest memory vector, and then calculate the distance between them. Each scale can obtain a distance (i.e. the third distance), and then the distances (i.e. the third distances) of various scales are integrated to determine whether the current sample is abnormal.

[0088] The multi-scale global memory queue is composed of N global memory queues, and the length of each global memory queue is defined as L. There are L memory units in each queue, and each memory unit is a vector with a length of C. When reasoning, the local memory feature of each scale is compared with the feature in the global memory queue of the corresponding scale, the nearest global memory unit is found, and the distance (i.e. the third distance) is calculated. When determining the anomaly, the distances (i.e. the third distances) of various scales are integrated for comprehensive determination. Specifically, the distances (i.e. the third distances) of various scales are weighted and averaged to obtain the comprehensive abnormal distance (multi-scale memory distance), i.e. the first distance.

[0089] Further, in order to more perfectly avoid the concept drift phenomenon of time series data, after taking the multi-scale memory distance as the first distance, the following steps can be included:

[0090] When the first distance is less than the threshold value, the time series data is normal, and the multi-scale local memory feature is updated to the global memory queue of the corresponding scale.

[0091] When the comprehensive abnormal distance (multi-scale memory distance / first distance) is greater than the preset threshold value, it is determined to be abnormal, otherwise it is normal. When it is determined to be normal, the memory unit in the global memory queue needs to be updated, i.e. the local memory feature of each scale is replaced with a memory unit in the global memory queue of the corresponding scale in a first-in-first-out manner.

[0092] S105: The time series data is abnormal when the first distance is greater than the threshold.

[0093] By applying the time series data anomaly detection method provided by the embodiment of the present application, the time series data is obtained, the time series data is input into the multi-scale feature coding network to obtain multi-scale data coding features, the multi-scale data coding features are input into the multi-scale local memory module to obtain multi-scale local memory features, the first distance is determined according to the multi-scale local memory features, and the time series data is abnormal when the first distance is greater than the threshold. This method can improve the feature learning ability, increase the generalization ability of the model, effectively avoid the abnormal data overfitting problem caused by the noise of the training data, improve the discrimination between the abnormal features and the normal features, and thus improve the detection accuracy. Moreover, the collected data is preprocessed: the time series data is smoothed, which is beneficial to the later processing; the time series data is preprocessed according to the set convolution step and the convolution kernel size, which improves the preprocessing effect; the sparsity of the memory module is constrained by using the sparse loss function, which reduces the reconstruction ability of the abnormal samples; the difference between the input and the output of the memory module is constrained by using the mapping loss function, which ensures that the memory module does not change the features by a large amplitude, improves the detection accuracy of the abnormal time series data; the global memory queue of the corresponding scale is used to compare the multi-scale local memory feature vectors to determine the first distance, which avoids the problem of abnormal detection accuracy caused by the concept drift of the time series data, improves the feature learning ability, and increases the generalization ability of the model; and when the time series data is normal, the multi-scale global memory queue is updated, which more perfectly avoids the concept drift phenomenon of the time series data.

[0094] In order to make the present application more convenient to understand, it can specifically include:

[0095] Please refer to Figure 3 , Figure 3A flowchart of a time series data anomaly detection training network is provided for an embodiment of the present application. Specifically, it includes: reading training data; initializing network layer weights; calculating multi-scale encoding features; calculating multi-scale local memory features; calculating multi-scale decoding features; calculating reconstruction error; single optimization operation, which refers to updating model parameter weights through backpropagation; methods that can be used for weight updating include but are not limited to SGD, RMSProp, Adam, Nesterov Accelerated Gradient or their combinations; reaching termination condition, determining whether to terminate the training of this branch; the termination condition can be that the total number of optimization times is set, or the loss value is less than a certain preset value; saving network weights. Save the corresponding network weights updated by training; end, end the model training process, where the training is in an end-to-end unsupervised training manner, and different stages and branches of the model are trained, updated and ended simultaneously. This embodiment takes three scales as an example. Please refer to Figure 4 , Figure 4 A structure diagram of a time series data anomaly detection training network is provided for an embodiment of the present application. The main purpose of the training network is to train feature encoding and local memory feature constraints, and the loss function of the training is the reconstruction error based on L2 norm (mean square error function). Through the training network, the encoding features and local memory features of the time series sequence can be obtained. Please refer to Figure 5 , Figure 5 A structure diagram of a local memory module network is provided for an embodiment of the present application. During training, two loss functions need to be constructed, one is a sparse loss function, which is used to constrain the sparsity of the memory module, thereby reducing the reconstruction ability of the abnormal samples, and the other is a mapping loss function, which is used to constrain the difference between the input and output of the memory module, to ensure that the memory module does not have a large amplitude change to the features. The core part of the local memory module is a learnable matrix M, which includes K memory units m1, m2, …, m k . For the output result z of the encoding module, first, cosine similarity calculation is needed with the local memory module; a distance matrix Dist(z, m) is obtained, then normalized by softmax, and a score matrix is obtained after normalization by softmax. Then, by performing matrix multiplication between the score matrix and the local memory module, the result of z obtained by the local memory module is obtained The projection loss is to make the change of the local memory module to z not too large, that is, The distance is calculated by using the square of L2 distance. The L2 distance is the most common distance representation between two points or multiple points, also known as Euclidean metric (also known as Euclidean distance), which is defined in Euclidean space. In order to make each memory unit distinguishable and avoid overfitting due to too dense memory units, a sparsity loss function is added to calculate the entropy of the score matrix w. Please refer to Figure 6 , Figure 6 The embodiment of the application provides a structure diagram of time series data anomaly detection. The comprehensive feature distance is calculated by comparing the distance between the multi-scale local memory feature and the global memory queue memory unit, and then the distance value is used for anomaly judgment. When it is greater than the preset threshold, it is abnormal, otherwise, it is normal. When it is normal, the memory unit in the global memory queue needs to be updated, and the updating method is to replace the memory unit of the corresponding scale in the global memory queue with the current obtained local memory feature in a first-in first-out manner. Through the replacement method, the generation of data concept drift can be effectively coped with.

[0096] The embodiment of the application provides a time series data anomaly detection device, and the time series data anomaly detection device described below can be correspondingly referred to the time series data anomaly detection method described above.

[0097] Please refer to Figure 7 , Figure 7 The structure diagram of the time series data anomaly detection device provided by the embodiment of the application can include:

[0098] The acquisition module 100 is used for acquiring time series data.

[0099] The multi-scale data coding feature extraction module 200 is used for inputting the time series data into a multi-scale feature coding network to obtain multi-scale data coding features.

[0100] The multi-scale local memory feature extraction module 300 is used for inputting the multi-scale data coding features into a multi-scale local memory module to obtain multi-scale local memory features.

[0101] The first distance determination module 400 is used for determining the first distance according to the multi-scale local memory features.

[0102] The data anomaly determination module 500 is used for determining that the time series data is abnormal when the first distance is greater than a threshold.

[0103] Based on the above embodiment, the first distance determination module 400 can include:

[0104] The first calculation unit is configured to calculate distances between the multi-scale local memory features and feature vectors in the global memory queue of the corresponding scale as second distances.

[0105] The global memory feature determination unit is configured to take the feature vector corresponding to the minimum distance in the second distances as a global memory feature.

[0106] The second calculation unit is configured to calculate distances between the multi-scale local memory features and the global memory feature as third distances.

[0107] The multi-scale memory distance determination unit is configured to obtain a multi-scale memory distance by weighting and averaging the third distances, and take the multi-scale memory distance as the first distance.

[0108] Based on the above embodiment, after the multi-scale memory distance determination unit, the method can further include:

[0109] The global memory queue updating unit is configured to, when the first distance is less than a threshold value, determine that the time series data is normal, and update the multi-scale local memory features into the global memory queue of the corresponding scale.

[0110] Based on the above embodiment, the loss function in the multi-scale local memory module training process in the multi-scale local memory feature extraction module 300 can include:

[0111] The calculation unit is configured to take a total loss function obtained by adding the sparse loss function and the mapping loss function as the loss function.

[0112] Based on the above embodiment, the acquisition module 100 can include:

[0113] The acquisition unit is configured to acquire initial time series data.

[0114] The normalization unit is configured to normalize the initial time series data to obtain normalized data.

[0115] The preprocessing unit is configured to perform a preprocessing operation on the normalized data through one-dimensional convolution to obtain preprocessed data, and take the preprocessed data as the time series data.

[0116] Based on the above embodiment, the preprocessing unit can include:

[0117] The parameter setting subunit is configured to set one-dimensional convolution parameters, including convolution step and convolution kernel size.

[0118] The preprocessing subunit is configured to perform one-dimensional convolution operation on the normalized data according to the one-dimensional convolution parameters to obtain the preprocessed data.

[0119] It should be noted that the modules and units in the above time series data anomaly detection device can be changed in sequence without affecting the logic.

[0120] The time series data anomaly detection device provided by the embodiment of the application comprises: an acquisition module 100, configured to acquire time series data; a multi-scale data coding feature extraction module 200, configured to input the time series data into a multi-scale feature coding network to obtain multi-scale data coding features; a multi-scale local memory feature extraction module 300, configured to input the multi-scale data coding features into a multi-scale local memory module to obtain multi-scale local memory features; a first distance determination module 400, configured to determine a first distance according to the multi-scale local memory features; and a data anomaly determination module 500, configured to determine that the time series data is abnormal when the first distance is greater than a threshold value.

[0121] The time series data anomaly detection device provided by the embodiment of the application comprises: an acquisition module 100, configured to acquire time series data; a multi-scale data coding feature extraction module 200, configured to input the time series data into a multi-scale feature coding network to obtain multi-scale data coding features; a multi-scale local memory feature extraction module 300, configured to input the multi-scale data coding features into a multi-scale local memory module to obtain multi-scale local memory features; a first distance determination module 400, configured to determine a first distance according to the multi-scale local memory features; and a data anomaly determination module 500, configured to determine that the time series data is abnormal when the first distance is greater than a threshold value.

[0122] Please refer to Figure 8 , Figure 8 The structure diagram of the time series data anomaly detection device provided by the embodiment of the application can comprise:

[0123] The memory 10 is configured to store a computer program.

[0124] The processor 20 is configured to execute the computer program to implement the time series data anomaly detection method.

[0125] The memory 10, the processor 20, the communication interface 31 and the communication bus 32. The memory 10, the processor 20, the communication interface 31 all complete the communication between each other through the communication bus 32.

[0126] In the embodiment of the application, the memory 10 stores one or more programs, which can include program codes including computer operation instructions. In the embodiment of the application, the memory 10 can store programs for implementing the following functions:

[0127] Obtaining timing data;

[0128] Inputting the timing data into a multi-scale feature coding network to obtain multi-scale data coding features;

[0129] Inputting the multi-scale data coding features into a multi-scale local memory module to obtain multi-scale local memory features;

[0130] Determining a first distance according to the multi-scale local memory features;

[0131] When the first distance is greater than a threshold, the timing data is abnormal.

[0132] In a possible implementation, the memory 10 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function, etc.; and the data storage area can store data created in the use process.

[0133] In addition, the memory 10 can include a read-only memory and a random access memory, and provide instructions and data for the processor. A part of the memory can also include an NVRAM. The memory stores an operating system and operation instructions, executable modules or data structures, or a subset or an extended set thereof, wherein the operation instructions can include various operation instructions for implementing various operations. The operating system can include various system programs for implementing various basic tasks and processing hardware-based tasks.

[0134] The processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic device, and the processor 20 can be a microprocessor or any conventional processor, etc. The processor 20 can call the program stored in the memory 10.

[0135] The communication interface 31 can be an interface of a communication module, used for connecting with other devices or systems.

[0136] Of course, it needs to be explained that, Figure 8The structure shown does not constitute a limitation on the time series data anomaly detection device in the embodiments of the present application, and in actual applications, the time series data anomaly detection device can include more or fewer components, or combine certain components. Figure 8

[0137] The storage medium provided by the embodiments of the present application is described below, and the storage medium described below can be referred to in conjunction with the time series data anomaly detection method described above.

[0138] The present application also provides a storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the time series data anomaly detection method.

[0139] The storage medium can include a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0140] In the specification, each embodiment is described in a progressive manner, and each embodiment focuses on the difference from other embodiments, and the same or similar parts of each embodiment can be referred to each other. For the device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0141] The skilled person can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0142] Finally, it should be noted that in this paper, relationships such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variant are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device.​

[0143] The above describes in detail the timing data anomaly detection method, device, equipment and computer readable storage medium provided by the present application. The principles and implementation manners of the present application are described by applying specific examples. The above example description is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for detecting anomalies in time series data, the method comprising: The method comprises: obtaining time series data; inputting the time series data into a multi-scale feature encoding network to obtain multi-scale data encoding features; inputting the multi-scale data encoding features into a multi-scale local memory module to obtain multi-scale local memory features; determining a first distance according to the multi-scale local memory features; when the first distance is greater than a threshold value, the time series data is abnormal; wherein the determining of the first distance according to the multi-scale local memory features comprises: calculating distances between the multi-scale local memory features and feature vectors in a global memory queue corresponding to the scale as second distances; taking a feature vector corresponding to a minimum distance in the second distances as a global memory feature; calculating a distance between the multi-scale local memory features and the global memory feature as a third distance; weighting and averaging the third distances to obtain a multi-scale memory distance, and taking the multi-scale memory distance as the first distance.

2. The method of claim 1, wherein, After the multi-scale memory distance is taken as the first distance, the method further comprises: when the first distance is less than the threshold value, the time series data is normal, and the multi-scale local memory features are updated into the global memory queue corresponding to the scale.

3. The method of claim 1, wherein, In the loss function in the training process of the multi-scale local memory module, the total loss function calculated by adding a sparse loss function and a mapping loss function is taken as the loss function. The method of obtaining time series data comprises:

4. The method of claim 1, wherein, obtaining initial time series data; normalizing the initial time series data to obtain normalized data; performing a preprocessing operation on the normalized data through one-dimensional convolution to obtain preprocessed data, and taking the preprocessed data as the time series data. The method of performing a preprocessing operation on the normalized data through one-dimensional convolution to obtain preprocessed data comprises:

5. The method of claim 4, wherein, setting one-dimensional convolution parameters, the one-dimensional convolution parameters comprising: a convolution step and a convolution kernel size; performing one-dimensional convolution operation on the normalized data according to the one-dimensional convolution parameters to obtain the preprocessed data. The method comprises:

6. A time series data anomaly detection apparatus characterized by comprising: an acquisition module configured to acquire time series data; a multi-scale data encoding feature extraction module configured to input the time series data into a multi-scale feature encoding network to obtain multi-scale data encoding features; a multi-scale local memory feature extraction module configured to input the multi-scale data encoding features into a multi-scale local memory module to obtain multi-scale local memory features; a first distance determination module configured to determine a first distance according to the multi-scale local memory features; a data abnormality determination module configured to determine that the time series data is abnormal when the first distance is greater than a threshold value; wherein the first distance determination module comprises: a first calculation unit configured to calculate distances between the multi-scale local memory features and feature vectors in a global memory queue corresponding to the scale as second distances; a global memory feature determination unit configured to take a feature vector corresponding to a minimum distance in the second distances as a global memory feature; a second calculation unit configured to calculate a distance between the multi-scale local memory features and the global memory feature as a third distance; ​ A multi-scale memory distance determination unit is configured to weight and average the third distances to obtain a multi-scale memory distance, and use the multi-scale memory distance as the first distance.

7. A time series data anomaly detection device characterized by comprising: The method comprises the following steps: A memory is configured to store a computer program. A processor is configured to execute the computer program to implement the steps of the time series data anomaly detection method according to any one of claims 1 to 5.

8. A readable storage medium, characterized by, The readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the time series data anomaly detection method according to any one of claims 1 to 5.

Images