A periodic time series anomaly detection method

Abstract

The application discloses a period time sequence anomaly detection method, comprising the following steps: step S1, historical time sequence data preprocessing; step S2, building an anomaly detection model based on GRU and an autoencoder network; step S3, training the model in a random shuffling manner; step S4, determining an anomaly detection threshold according to training data; and step S5, performing anomaly detection. The core idea of the method is that the original time sequence is subjected to a GRU-AE model to obtain a reconstructed sequence, the reconstruction error between the original time sequence and the reconstructed time sequence is calculated, and finally, the anomaly points in the sequence are identified according to the reconstruction error. In the application, a multi-time node input mode is adopted to accelerate the training speed of the model, better learn the rules between time sequences, and a new model training mode is proposed to reduce the overfitting phenomenon.

Description

Technical Field

[0001] This invention relates to the field of time series analysis technology, specifically to a method for detecting anomalies in periodic time series, and more particularly to a time series anomaly detection method based on GRU-AutoEncoder. Background Technology

[0002] The goal of time series anomaly detection is to identify points that do not match the expected behavior of a normal time series. These anomalies can negatively impact data analysis, so data analysts want them to be detected promptly. Due to the underlying forces driven by human activity, time series (such as wireless communication network load, massive traffic flow data, and power grid data) often exhibit strong periodicity. Anomaly detection for such regular sequences has always been a key focus in the field of data mining.

[0003] Time series anomalies can generally be categorized into three types: point anomalies, context anomalies, and collective anomalies. Point anomalies are single anomalous data points that do not conform to the normal behavior of the entire time series (e.g., very large / very small outliers). Context anomalies refer to outliers whose values ​​are within the normal range but do not conform to the data's pattern of change. Collective anomalies refer to a group of anomalies where preceding and following sequences exhibit significantly different patterns.

[0004] Among existing time series anomaly detection techniques, deep learning-based methods have attracted significant attention from researchers. However, due to the low frequency of anomalies, researchers struggle to obtain sufficient anomaly labels to train neural networks using supervised learning. Therefore, unsupervised learning-based AutoEncoders (AEs) have become the mainstream approach for periodic time series anomaly detection. Nevertheless, existing AutoEncoders still suffer from long training cycles and are prone to overfitting. Summary of the Invention

[0005] To address the shortcomings of the above methods, this invention aims to provide an unsupervised learning approach for training a GRU-AutoEncoder (GRU-AE) time series anomaly detection method. The core idea of ​​this method is to process the original time series through a GRU-AE model to obtain a reconstructed sequence, then calculate the reconstruction error between the original and reconstructed time series, and finally identify anomalies in the sequence based on the reconstruction error. This invention employs a multi-time-node input method to accelerate model training and better learn the patterns between time series. Furthermore, a novel model training method is proposed to reduce overfitting.

[0006] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0007] Step S1: Preprocessing of historical time series data.

[0008] Step S2: Build an anomaly detection model based on GRU and autoencoder networks.

[0009] Step S3: Train the model using a random shuffle method.

[0010] Step S4: Determine the anomaly detection threshold based on the training data.

[0011] Step S5: Perform anomaly detection.

[0012] Preferably, step S1 data preprocessing includes the following steps:

[0013] Before performing historical time series preprocessing, linear interpolation is preferentially used to impute missing values ​​in the historical time series. Let the original time series be t = {t1, t2, ... t}. n}, where n is the sequence length, t i Let be the value of the sequence at time i, where i ∈ {1, 2, 3, ..., n}. The MIN-MAX normalization method can be defined as:

[0014]

[0015] Where max(t) is the maximum value in time series t, and min(t) is the minimum value in time series t. The normalized result of time series t is t′={t′1,t′2,...t′ n}, and all values ​​are controlled within [0, 1].

[0016] Preferably, the anomaly detection model in step S2 is constructed as follows:

[0017] The model employs an AutoEncoder, where both the encoder and decoder use GRU units. To improve efficiency, a self-attention mechanism is added between the encoder and decoder. The entire model is used to reconstruct the input sequence.

[0018] (1) An AutoEncoder consists of an encoder and a decoder. Assume the input of the encoder is x = {x1, x2, ... x}. n The encoder compresses an n-dimensional vector x into an m-dimensional vector H = {h1, h2, ... h}. m (Usually m < n), the decoder then decompresses the m-dimensional vector H into an n-dimensional vector x′ = {x′1, x′2, ... x′}. n The goal of an autoencoder is to minimize the loss function f. loss =|xx′| 2 .

[0019] (2) GRU is a variant of recurrent neural networks. A GRU unit contains two gates: an update gate and a forget gate. The forget gate determines the amount of information that is forgotten, and the update gate defines the amount of previous memory that is saved to the current time step. GRU units are commonly used for time series modeling. The encoder and decoder of the GRU-AutoEncoder model use GRU units to better learn the patterns between time series.

[0020] (3) The Attention mechanism is designed to improve the training efficiency of the encoder and decoder of the AutoEncoder. The attention mechanism allows the decoder to give different levels of attention to each output of the encoder at each time step.

[0021] Preferably, the steps for training the model using the random shuffling method in step S3 are as follows:

[0022] For a sequentially input time series x, the traditional method for training a GRU-AutoEncoder model is to reconstruct the input sequence x′ sequentially and calculate the loss function f between the input sequence and the reconstructed sequence. loss Update the GRU-AutoEncoder model parameters to minimize the error function f. loss The random shuffling training method has a certain probability of causing the GRU-AutoEncoder to shuffle the reconstruction order during reconstruction, thus preventing overfitting.

[0023] Preferably, step S4, which determines the anomaly detection threshold based on the training data, is as follows:

[0024] After training the GRU-AutoEncoder model, the final distribution of the training set is statistically analyzed, and the upper threshold R of the reconstruction error is determined by plotting a CDF diagram. up and the threshold R under reconstruction error low (R up >R low ).

[0025] Preferably, step S5 performs the anomaly detection step as follows:

[0026] Anomaly detection involves three steps: data preprocessing, data reconstruction, and anomaly detection.

[0027] (1) Preprocessing of data to be detected

[0028] The preprocessing steps for the data to be tested are the same as those for historical data, and will not be repeated here.

[0029] (2) Reconstruction of the data to be detected

[0030] Let the time series to be detected be x = {x1, x2, ... x}. nAfter reconstruction by the GRU-AutoEncoder model, we get x′={x′1,x′2,...x′}. n}

[0031] (3) Abnormal detection

[0032] Calculate the reconstruction error R between the time series x and the reconstructed series x′. error ={r1,r2,...r n}, where r i =x i -x′ i Let r be the reconstruction error at time i, i∈{1,2,…n}, based on the obtained reconstruction error r i The outliers are compared with the threshold obtained in step S4 to filter them. The outlier filtering method is as follows:

[0033]

[0034] This invention has the following characteristics and beneficial effects:

[0035] The anomaly detection algorithm employing the above technical solution, which uses a Gated Recurrent Unit (GRU) and an autoencoder as its network framework, demonstrates superior anomaly detection capabilities compared to other Autoencoder anomaly detection models. This is achieved through multi-time-node input and random shuffling during model training. Furthermore, it requires less processing of the original data, making it more convenient and practical. This invention has broad applicability and is suitable for anomaly detection in periodic data. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is the overall anomaly detection framework of the present invention.

[0038] Figure 2 This is the GRU-AutoEncoder model in an embodiment of the present invention.

[0039] Figure 3 This is a structural diagram of the GRU according to an embodiment of the present invention.

[0040] Figure 4 This is an example diagram of context anomaly detection in an embodiment of the present invention.

[0041] Figure 5 This is an example diagram of collective anomaly detection in an embodiment of the present invention. Detailed Implementation

[0042] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0043] The data used in this invention is network traffic data collected by a communication base station. This type of data records the base station load at different locations in a certain city, with a time granularity of 1 hour and a data span from January 15, 2018 to July 8, 2018. Preliminary analysis of the data revealed that, due to the influence of human activities, the data exhibits daily or weekly patterns. Furthermore, in the weekly pattern data, there are significant differences between weekdays and weekends, and anomalies are categorized into three types: point anomalies, contextual anomalies, and collective anomalies.

[0044] Example 1

[0045] This embodiment provides a method for detecting anomalies in periodic time series, as detailed below:

[0046] Step S1: Preprocessing of historical time series data.

[0047] Let the historical time series be t = {t1, t2, ... t}. n After missing value imputation and data normalization, the sequence t′={t′1,t′2,...t′} is obtained. n}

[0048] Next, the normalized sequence t′ is processed into a sequence with a time span of 24 hours, and the step size between two adjacent input sequences is also 24 hours. The i-th input sequence is represented by x. di ={t i*24 ′,t i*24+1 ′,…,t i*24+23 The '} indicates that within this time span, a single input sequence contains only data information for a single day, and therefore can only detect point anomalies and context anomalies.

[0049] Step S2: Building the anomaly detection model.

[0050] The GRU-AutoEncoder module, composed of AutoEncoder, GRU, and Attention mechanisms, is used to reconstruct sequences with three different time spans and calculate the reconstruction error between the original and reconstructed sequences. The GRU-AutoEncoder model is as follows: Figure 2 As shown.

[0051] Further details regarding the GRU-AutoEncoder module:

[0052] An AutoEncoder consists of an encoder and a decoder. For an n-dimensional time series x = {x1, x2, ... x}, n The encoder compresses the sequence into an m-dimensional sequence (usually m < n), and the decoder decompresses the compressed m-dimensional sequence back into n dimensions to obtain the reconstructed sequence x′ = {x′1, x′2, ... x′}. n The GRU-AutoEncoder uses GRU units in both its encoder and decoder. The structure diagram of the GRU is shown below. Figure 3 As shown, the encoder's data flow is as follows, assuming the input is x = {x1, x2, ... x}. n First, x1 enters the first GRU unit and obtains the current state. Current status Together with x2 from the next time step, it is sent to the next GRU unit to obtain the state of the next time step. Repeat this step until the final state is output. Therefore, the output of the entire encoder At the same time, the last state of the encoder will be... It is transmitted to the first GRU unit of the decoder as the initial state of the decoder;

[0053] The input to the decoder GRU unit is the current state of the decoder. The input is fed into the Attention mechanism and processed with the output of each encoder to obtain the attention score α. jt Attention score α jt After passing through the softmax function, the weight coefficients α′ are obtained. jt The Attention mechanism is based on the encoder's output N. en After reweighting, the input to the j-th decoder can be represented as... in The core of the attention mechanism is to allow the decoder to give different levels of attention to each hidden state of the encoder at each time step. Adding the attention mechanism also speeds up model training. The attention mechanism is a parameter that needs to be learned. In the decoder, decoding is performed in reverse order, that is, x′ is reconstructed first. n Finally, x′1 is reconstructed, the sequence order is adjusted, and the decoder output x′={x′1,x′2,...x′} is obtained. n The reconstruction error can be expressed as R. error =x′-x.

[0054] The GRU-AutoEncoder model corresponding to the input sequence with a time scale of 24 hours obtained after preprocessing is denoted as M1.

[0055] Step S3: Train the model.

[0056] The historical time series with a time scale of 24 hours obtained in step 1 is input into the GRU-AutoEncoder built in step 2 to train the M1 model. The training process is explained with reference to Figure 2. For an n-dimensional input sequence x = {x1, x2, ... x...} n In traditional training methods, the input is reconstructed sequentially in reverse order, for example, reconstructing x first. n Secondly, x is reconstructed. n-1 Finally, x1 is reconstructed, and the order of the reconstructed sequence is adjusted to obtain the reconstructed sequence x′={x′1,x′2,...x′}. n}. Calculate the loss function f between the input sequence x and the reconstructed sequence x′. loss Update the parameters of the GRU-AutoEncoder model.

[0057] In the random shuffling training method, the model has a certain probability of shuffling the reconstruction order, and the shuffling order is random. In this case, the priority of reconstruction is uncertain. When the probability does not occur, the input sequence is reconstructed in the traditional way. Finally, the loss function is calculated based on the input sequence and the reconstructed sequence to update the GRU-AutoEncoder model parameters. This method is only used when updating M... 10 M6 model parameters.

[0058] Step S4: Determine the anomaly detection threshold based on the training data.

[0059] After training the M1 model in step S3, the reconstruction error of the historical data under the corresponding model is statistically analyzed, and a CDF diagram is drawn. Then, the upper and lower thresholds of the reconstruction error under the corresponding model are selected.

[0060] Step S5: Perform anomaly detection.

[0061] Anomaly detection involves three steps: data preprocessing, data reconstruction, and anomaly detection.

[0062] 1) Preprocessing of data to be detected

[0063] The preprocessing steps for the data to be detected are the same as those for historical data, and the data to be detected is also processed into three different time scales, x di ={t i*24 ′,t i*24+1 ′,…,t i*24+23 The above steps are the same as step 1, and will not be repeated here.

[0064] 2) Reconstruction of the data to be detected

[0065] After preprocessing the data to be detected, an input sequence x with a time scale of 24 hours is obtained. di The reconstructed sequence x is obtained by sending it to M1. di ′.

[0066] 3) Abnormal detection

[0067] Calculate the reconstruction error between the input sequence and the reconstructed sequence at this time scale, where the time scale is 24 hours. Where rj is the reconstruction error at time j, j∈{i*24,i*24+1,…i*24+23}. Based on the reconstruction error r... j The threshold obtained in step S4 on a 24-hour time scale is compared to the threshold for outlier screening.

[0068] When the timescale is 10 days, only the reconstruction error of the last time step is calculated.

[0069] R w =w9-w9′={r (i+9)*24 ,r (i+9)*24+1 ,…,r (i+9)*24+23 Since the time step of the input sequence is 24 hours at this time scale, the reconstruction error can be calculated for all time points. The reconstruction error is then compared with the threshold obtained in step S4 at a time scale of 10 days to filter out outliers. The processing for a time scale of 6 days is similar to that for 10 days.

[0070] Example 2

[0071] The difference between this embodiment and Embodiment 1 is that the time span is 10 days, the step size of two adjacent input sequences is also 24 hours, and the i-th input sequence is represented by x. wi ={w i*24 ,w i*24+1 ,…,w i*24+239 This indicates that, within this time span, a single input sequence contains data from 10 working days. The model can combine the states of preceding and following working days, primarily used to detect collective anomalies within the working days. At this scale, the GRU-AutoEncoder requires a relatively long time period to capture the cyclical changes in the sequence. If the sequence is input into the network point by point using traditional methods, the long time span not only makes training cumbersome but also makes it difficult for the model to capture seasonal variations between sequences. Based on this, the input sequence is summed into a single vector for each day as a time step and fed into the GRU-AutoEncoder model, i.e., x... wi = {w0, w1, ..., w9}, where w k ={w (i+k)*24 ,w (i+k)*24+1 ,…,w (i+k)*24+23This operation not only solves the problem of long model training cycles, but also captures seasonal variations between sequences.

[0072] Specifically as follows:

[0073] Step S1: Preprocessing of historical time series data.

[0074] Let the historical time series be t = {t1, t2, ... t}. n After missing value imputation and data normalization, the sequence t′={t′1,t′2,...t′} is obtained. n}

[0075] Next, the normalized sequence t′ is processed into a sequence with a time span of 10 days, and the step size between two adjacent input sequences is also 24 hours. The i-th input sequence is represented by x. wi ={w i*24 ,w i*24+1 ,…,w i*24+239 The input sequence contains data from 10 working days. The model combines the states of preceding and following working days, primarily used to detect collective anomalies within the working days. At this working scale, the GRU-AutoEncoder requires a relatively long time period to capture the cyclical changes in the sequence. If the sequence is input into the network point-by-point using traditional methods, the long time span not only makes training cumbersome but also makes it difficult for the model to capture seasonal variations between sequences. Therefore, the input sequence is summed into a single vector for each day as a time step and fed into the GRU-AutoEncoder model, i.e., x... wi = {w0, w1, ..., w9}, where w k ={w (i+k)*24 ,w (i+k)*24+1 ,…,w (i+k)*24+23 This operation not only solves the problem of long model training cycles, but also captures seasonal variations between sequences.

[0076] Step S2: Building the anomaly detection model.

[0077] The GRU-AutoEncoder module, composed of AutoEncoder, GRU, and Attention mechanisms, is used to reconstruct sequences with three different time spans and calculate the reconstruction error between the original time series and the reconstructed sequence.

[0078] Further details regarding the GRU-AutoEncoder module:

[0079] An AutoEncoder consists of an encoder and a decoder. For an n-dimensional time series x = {x1, x2, ... x}, n The encoder compresses the sequence into an m-dimensional sequence (usually m < n), and the decoder decompresses the compressed m-dimensional sequence back into n dimensions to obtain the reconstructed sequence x′ = {x′1, x′2, ... x′}. n The GRU-AutoEncoder uses GRU units for both its encoder and decoder. The structure diagram of the GRU and the encoder's data flow are as follows, assuming the input is x = {x1, x2, ... x}. n First, x1 enters the first GRU unit and obtains the current state. Current status Together with x2 from the next time step, it is sent to the next GRU unit to obtain the state of the next time step. Repeat this step until the final state is output. Therefore, the output of the entire encoder At the same time, the last state of the encoder will be... It is transmitted to the first GRU unit of the decoder as the initial state of the decoder;

[0080] The input to the decoder GRU unit is the current state of the decoder. The input is fed into the Attention mechanism and processed with the output of each encoder to obtain the attention score α. jt Attention score α jt After passing through the softmax function, the weight coefficients α′ are obtained. jt The Attention mechanism is based on the encoder's output N. en After reweighting, the input to the j-th decoder can be represented as... in The core of the attention mechanism is to allow the decoder to give different levels of attention to each hidden state of the encoder at each time step. Adding the attention mechanism also speeds up model training. The attention mechanism is a parameter that needs to be learned. In the decoder, decoding is performed in reverse order, that is, x′ is reconstructed first. n Finally, x′1 is reconstructed, the sequence order is adjusted, and the decoder output x′={x′1,x′2,...x′} is obtained. n The reconstruction error can be expressed as R. error =x′-x.

[0081] The GRU-AutoEncoder model corresponding to the input sequence with a time scale of 10 days after preprocessing is denoted as M. 10 .

[0082] Step S3: Train the model.

[0083] The historical time series obtained in step 1 with a time scale of 10 days is input into the GRU-AutoEncoder built in step 2 to train M. 10 The model employs a randomized shuffling training method, where the model has a certain probability of shuffling the reconstruction order, and this shuffling order is random. In this case, the priority of reconstruction is uncertain. When the probability does not occur, the input sequence is reconstructed using the traditional method described in Example 1. Finally, the loss function is calculated based on the input sequence and the reconstructed sequence to update the GRU-AutoEncoder model parameters. This method is only applied when updating M... 10 Model parameters.

[0084] Step S4: Determine the anomaly detection threshold based on the training data.

[0085] M was trained in step S3 10 The model is used to statistically analyze the reconstruction error of historical data under the corresponding model. After plotting the CDF diagram, the upper and lower thresholds of the reconstruction error under the corresponding model are selected.

[0086] Step S5: Perform anomaly detection.

[0087] Anomaly detection involves three steps: data preprocessing, data reconstruction, and anomaly detection.

[0088] 1) Preprocessing of data to be detected

[0089] The preprocessing steps for the data to be detected are the same as those for historical data, and the data to be detected is also processed into three different time scales, x wi = {w0, w1, ..., w9}, where w k ={w (i+k)*24 ,w (i+k)*24+1 ,…,w (i+k)*24+23 The above steps are the same as step 1, and will not be repeated here.

[0090] 2) Reconstruction of the data to be detected

[0091] After preprocessing the data to be detected, an input sequence x with a time scale of 10 days is obtained. wi Sent to M 10 The reconstructed sequence x is obtained from wi ′.

[0092] 3) Abnormal detection

[0093] Calculate the reconstruction error between the input sequence and the reconstructed sequence at this time scale. When the time scale is 10 days, only calculate the reconstruction error R of the last time step. w =w9-w9′={r(i+9)*24 ,r (i+9)*24+1 ,…,r (i+9)*24+23 Since the time step of the input sequence is 24 hours at this time scale, the reconstruction error can be calculated for all time points. The reconstruction error is then compared with the threshold obtained in step S4 at a time scale of 10 days to filter out outliers.

[0094] Example 3

[0095] The difference between this embodiment and Embodiment 2 is that the time span is 6 days, the step size of two adjacent input sequences is also 24 hours, and the i-th input sequence is represented by x. oi ={o i*24 ,o i*24+1 ,…,o i*24+143 The statement indicates that it is mainly used to detect collective anomalies on weekends. The input method is the same as that for a time span of 10 days, so it will not be repeated here. The input sequence can be described as x oi ={o0,o1,…,o5}, where o k ={o (i+k)*24 ,o (i+k)*24 +1,…,o (i+k)*24+23}

[0096] Other technical features in this embodiment are the same as those in Embodiment 2, and will not be described in detail in this embodiment.

[0097] Further explanation is provided based on the experimental results of Examples 1, 2, and 3:

[0098] Table 1 shows the parameters of the GRU-Autoencoder model at three different time scales, and Figure 4 , Figure 5 Example diagrams for detecting contextual anomalies and collective anomalies are shown respectively.

[0099] Table 1: Design of GRU-Autoencoder Model Parameters

[0100]

[0101] Where k represents the dimension of the Attention mechanism, l represents the dimension of GRU in the GRU-AutoEncoder model, and ξ represents the random probability.

[0102] Table 2: Selection of Reconstruction Error Threshold

[0103]

[0104] Since anomalies constitute only a small portion of the data, only accuracy is used. Recall is also included to describe the model's performance. and The model was evaluated. TP represents true positives, FP represents false positives, and FN represents false negatives. The statistically significant results showed that the precision, recall, and F-score were 94.5%, 92.4%, and 93.4%, respectively.

[0105] This invention proposes an anomaly detection algorithm that uses random shuffling as the training method and a gated recurrent unit (GRU) and an autoencoder as the network framework. The main contributions are as follows:

[0106] 1. In a multi-day working mode, the GRU-AutoEncoder model does not use the traditional time granularity as the step input. Instead, it stacks the whole day into a vector and inputs it into the GRU-AutoEncoder network as a time step. This not only reduces the number of time steps in GRU and the training time of the model, but also makes it easier to capture the seasonal changes of the sequence.

[0107] 2. In terms of model training methods, a random shuffle algorithm has been added to effectively prevent overfitting of the model.

[0108] Use M1, M 10 Three models, M1, M2, and M6, detect three types of anomalies. The M1 model has a shorter time span and does not incorporate information from different days; it primarily detects point-based anomalies and contextual anomalies. 10 With the M6 ​​model, the time span is longer, and the model can combine the relationship between weekdays (weekends) to mainly detect collective anomalies.

[0109] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions, and variations can be made to these embodiments, including components, without departing from the principles and spirit of the present invention, and these variations still fall within the protection scope of the present invention.

Claims

1. A method for detecting anomalies in periodic time series, characterized in that, Includes the following steps: Step S1: Preprocessing historical time series data; S1-1. Use linear interpolation to fill missing values ​​in historical time series, where the historical time series is t = {t1, t2, ... t}. n }, where n is the sequence length, t i Let i be the value of the sequence at time i, where i ∈ {1, 2, 3, ..., n}; S1-2. Perform MIN-MAX normalization on the historical time series after missing value imputation to obtain t′={t1′,t′2,...t′ n }; The MIN-MAX normalization method is defined as follows: Where max(t) is the maximum value in time series t, and min(t) is the minimum value in time series t. The normalized result of time series t is t′={t′1,t′2,...t′ n And all values ​​are controlled within [0, 1]. Step S2: Build an anomaly detection model The system adopts the AutoEncoder model, where both the encoder and decoder use GRU units, and a self-attention mechanism is added between the encoder and decoder. Step S3: Train the anomaly detection model; The method for training the anomaly detection model is a random shuffle training method, as detailed below: For the input n-dimensional sequence x = {x1, x2, ... x...} n The reconstruction order is randomly shuffled, and finally the parameters of the anomaly detection model are updated based on the mean squared error loss function of the input sequence and the reconstructed sequence. When the reconstruction order is shuffled, if the input is not shuffled, it is reconstructed in reverse order, prioritizing the reconstruction of x. n Secondly, x is reconstructed. n-1 Finally, x1 is reconstructed, and the order of the reconstructed sequence is adjusted to obtain the reconstructed sequence x′={x1′,x′2,...x′}. n }, calculate the minimum loss function f between the input sequence x and the reconstructed sequence x′. loss Update the parameters of the anomaly detection model; Step S4: Determine the anomaly detection threshold based on the training data. The method for determining the anomaly detection threshold is as follows: statistically analyze the reconstruction error of historical data, draw a CDF diagram, and select an upper threshold and a lower threshold based on the principle that anomalies are low-probability events and the statistical analysis of reconstruction error. Step S5: Perform anomaly detection. The method for performing anomaly detection is as follows: S5-1. Preprocess the time series to be detected through step S1; S5-2. Let the preprocessed time series to be detected be x={x1,x2,...x n After reconstruction using the anomaly detection model, the reconstructed sequence x′={x1′,x′2,...x′} is obtained. n }; S5-3. Calculate the reconstruction error R of the time series x and the reconstructed series x′. error ={r1,r2,...r n }, where r i =x i ′-x i Let r be the reconstruction error at time i, i∈{1,2,…n}, based on the obtained reconstruction error r i The values ​​are compared with the threshold obtained in step S4 to filter out outliers. The method for filtering outliers is as follows: Among them, R up It is the upper threshold of the reconstruction error, R low It is the lower threshold of the reconstruction error.

2. The periodic time series anomaly detection method according to claim 1, characterized in that, The operation method of the anomaly detection model is as follows: The data flow of the encoder GRU unit is as follows, assuming the input is x = {x1, x2, ... x}. n First, x1 enters the first GRU unit and obtains the current state. Current status Together with x2 from the next time step, it is sent to the next GRU unit to obtain the state of the next time step. Repeat this step until the final state is output. Therefore, the output of the entire encoder At the same time, the last state of the encoder will be... It is transmitted to the first GRU unit of the decoder as the initial state of the decoder; The input to the decoder GRU unit is the current state of the decoder. The input is fed into the Attention mechanism and processed with the output of each encoder to obtain the attention score α. jt Attention score α jt After passing through the softmax function, the weight coefficients α′ are obtained. jt The Attention mechanism is based on the encoder's output N. en After reweighting, the input to the j-th decoder is represented as... in The core of the attention mechanism is to allow the decoder to give different levels of attention to each hidden state of the encoder at each time step. Adding the attention mechanism also speeds up model training. The attention mechanism is a parameter that needs to be learned. In the decoder, decoding is performed in reverse order, that is, x′ is reconstructed first. n Finally, x1′ is reconstructed, the sequence order is adjusted, and the decoder output x′={x1′,x′2,...x′} is obtained. n The reconstruction error is expressed as R. error =x′-x.

3. The periodic time series anomaly detection method according to claim 2, characterized in that, The minimized loss function f loss The expression is as follows: f loss =|x′-x| 2 。

Images