Time series data unsupervised anomaly detection model training method and device, time series data unsupervised anomaly detection method and device
By perturbing the time series data to generate negative samples and combining non-Euclidean distance and binary cross-entropy loss function to train the detection model, the problem of training set contamination in unsupervised time series anomaly detection is solved, and the model's recognition accuracy and robustness are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HARBIN UNIV OF SCI & TECH
- Filing Date
- 2023-03-09
- Publication Date
- 2026-05-12
AI Technical Summary
In unsupervised time series anomaly detection, the training set is contaminated, leading to biases in the learning process and inaccurate definitions of normal boundaries, making it difficult to effectively identify anomalous data.
By perturbing the time series data to generate negative samples, the detection model is trained using non-Euclidean distance and binary cross-entropy loss function, and combined with a context error correction mechanism, the model's ability to identify anomalies is enhanced.
It effectively reduces the negative impact of training set anomaly contamination, improves the model's accuracy and robustness in identifying anomalous data, and ensures correct prediction results.
Smart Images
Figure CN116244632B_ABST
Abstract
Description
Technical Field
[0001] It involves the field of time series technology, specifically the detection of time series data anomalies. Background Technology
[0002] In recent decades, with the rapid development of information technology, a massive amount of time-series data has been continuously created. Due to the functional states of various target systems, such as large data centers, cloud servers, spacecraft, and even the human body, this time-series data serves as a source. This invention can monitor and alert to potential faults, threats, and risks in target systems by identifying abnormal states (i.e., anomalies). Anomaly detection is an important area of data mining and analysis, aiming to discover anomalous data observations that significantly differ from the majority of the data, which plays a crucial role in achieving this goal. Due to the cost and difficulty of labeling in these practical applications, time-series anomaly detection is often defined as an unsupervised task involving unlabeled training data.
[0003] Unsupervised time series anomaly detection, without the guidance of a supervised signal, typically relies on learning the normality of data through a classification model. However, this learning process faces two key challenges: (1) the presence of unknown anomalies in the training set, and (2) a lack of knowledge about the anomalies of interest. Specifically, the learning process can be biased by hidden anomalies in the training set (i.e., anomaly contamination), as the entire training set is typically fed into a classification model by directly assuming all observations are normal. Anomaly contamination can significantly interfere with the learning process, leading to severe overfitting. Furthermore, during the learning process, inaccurate normality boundaries may be discovered without understanding the true anomalies, as it is difficult to define the range of normal behavior in such cases. Summary of the Invention
[0004] To address the problem of dataset contamination in unsupervised time series anomaly detection in existing technologies, the technical solution provided by this invention is as follows:
[0005] A method for training an unsupervised anomaly detection model for time-series data, the method comprising:
[0006] Step 1: Collect a set of time series data of univariate time series, and preprocess the time series data to generate initial time domain data and frequency domain data;
[0007] Step 2: Train the detection model based on the frequency domain data and the initial time domain data.
[0008] Furthermore, a preferred embodiment is provided, wherein in step 1, the preprocessing includes: performing data standardization, data partitioning, and modality transformation on the time series data.
[0009] Furthermore, a preferred embodiment is provided, wherein in step 2, the method for training the detection model is specifically as follows: two low-dimensional embeddings are obtained based on the frequency domain data and the initial time domain data, respectively, and the detection model is trained based on the two low-dimensional embeddings.
[0010] Based on the same inventive concept, the present invention also provides a training device for an unsupervised anomaly detection model for time series data, the device comprising:
[0011] Module 1: Used to collect time series data sets of univariate time series, and preprocess the time series data to generate initial time domain data and frequency domain data;
[0012] Module 2: Used to train a detection model based on the frequency domain data and the initial time domain data.
[0013] Furthermore, a preferred embodiment is provided, wherein the preprocessing in module 1 includes: performing data standardization, data partitioning, and modality transformation on the time-series data.
[0014] Furthermore, a preferred embodiment is provided, wherein the specific implementation of training the detection model in module 2 is as follows: two low-dimensional embeddings are obtained based on the frequency domain data and the initial time domain data, respectively, and the detection model is trained based on the two low-dimensional embeddings.
[0015] Based on the same inventive concept, this invention also provides a method for unsupervised anomaly detection in time-series data, the method comprising:
[0016] Step 3: Train the detection model;
[0017] The training and detection method is the same as the time-series data unsupervised anomaly detection model training method.
[0018] Step 4: Verify the detection model. If the verification result meets the preset requirements, proceed to Step 5.
[0019] Step 5: Detect the time series data set according to the detection model.
[0020] Based on the same inventive concept, the present invention also provides a time-series data unsupervised anomaly detection device, the device comprising:
[0021] Module 3: Used for training the detection model;
[0022] The training and detection module is the time-series data unsupervised anomaly detection model training device.
[0023] Module 4: Used to verify the detection model. If the verification result meets the preset requirements, then Module 5 is executed.
[0024] Module 5: Used to perform detection on the time series data set according to the detection model.
[0025] Based on the same inventive concept, the present invention also provides a computer storage medium for storing a computer program, characterized in that the computer program stored in the medium is used to be read by a computer to execute the time-series data unsupervised anomaly detection model training method or the time-series data unsupervised anomaly detection method.
[0026] Based on the same inventive concept, the present invention also provides a computer, including a processor and a storage medium, wherein the storage medium is used to store a computer program, characterized in that, when the processor reads the computer program, the computer executes the time-series data unsupervised anomaly detection model training method or the time-series data unsupervised anomaly detection method.
[0027] Compared with the prior art, the advantages of the present invention are:
[0028] The unsupervised anomaly detection method for time series data provided by this invention transfers the idea of non-Euclidean distance to time series. It generates a negative sample as perceived by the model through a data perturbation method, and trains the model with both positive and negative samples simultaneously. This helps to solve the problem of contamination in the model's training set, resulting in better training results.
[0029] The unsupervised anomaly detection method for time-series data provided by this invention designs a way to correct errors in both the upper and lower parts simultaneously. This technique can also be seen as using the classification task below as a way to correct the error of the samples above, and the weight of each sample is adjusted according to the BCELoss error.
[0030] The unsupervised anomaly detection method for time-series data provided by this invention solves the problem of dataset contamination in anomaly detection in existing technologies, and addresses the problem of training set anomaly contamination by reducing the negative impact of training set anomaly contamination. Furthermore, it introduces knowledge of training set anomalies into the learning process, thereby correcting inaccurate data boundaries generated during model training.
[0031] The unsupervised anomaly detection method for time-series data provided by this invention corrects inaccurate predictions by embedding a new learning objective based on the concept of uncertainty, while encouraging more confident predictions to ensure effective learning of correct sample features. Therefore, this process can distinguish harmful anomalies, thereby masking anomaly contamination problems during network optimization.
[0032] The unsupervised anomaly detection method for time-series data provided by this invention simulates real anomalous behavior by performing customized data perturbation operations on the original time-series data, providing reliable original anomaly examples. It eliminates the influence of anomaly contamination through adaptive penalty of uncertain predictions, while increasing the weight of correct prediction results. Furthermore, by distinguishing between normal samples and generated naturally occurring anomaly samples, it simulates real time-series anomalous behavior based on the original data. These two calibrations lead to first-level learning of contamination tolerance and anomaly notification, thereby significantly improving normality modeling.
[0033] It is suitable for use in unsupervised time series anomaly detection. Attached Figure Description
[0034] Figure 1 This is a flowchart illustrating the unsupervised anomaly detection method for time-series data mentioned in Implementation Method 1;
[0035] Figure 2 This is a flowchart illustrating the data input model mentioned in Implementation Method 1;
[0036] Figure 3 This is a flowchart illustrating the formal training model mentioned in Implementation Method 1;
[0037] Figure 4 This is a flowchart illustrating the test and detection model mentioned in Implementation Method Seven. Detailed Implementation
[0038] To make the advantages and benefits of the technical solution provided by the present invention clearer, the technical solution provided by the present invention will now be described in further detail with reference to the accompanying drawings, specifically:
[0039] Implementation Method 1: Combination Figure 1-3 This embodiment describes a method for training an unsupervised anomaly detection model for time series data, characterized in that the method includes:
[0040] Step 1: Collect a set of time series data of univariate time series, and preprocess the time series data to generate initial time domain data and frequency domain data;
[0041] Step 2: Train the detection model based on the frequency domain data and the initial time domain data.
[0042] Specifically, such as Figure 1 As shown, the method includes:
[0043] Given time series data, whose features consist of time and frequency domains, the original data is perturbed in random ways, including point anomalies, context anomalies, and all anomalies. The perturbed dataset and the original dataset are then placed in a feature extraction network (TCN) for feature extraction.
[0044] Data input stage, such as Figure 2 Given a time series input, which consists of time-domain features and frequency-domain features, the data features are perturbed according to a certain ratio to generate negative sample data as perceived by the model. Then, the original data and the perturbed data are simultaneously input into the TCN feature extraction network for feature extraction. Finally, the data is input into the upper and lower parts of the model for training.
[0045] The formal training phase of the model involves the following process: Figure 3 As shown, the dataset is split into training, validation, and test sets in a 6:2:2 ratio;
[0046] Implementation Method 2: This implementation method further defines the unsupervised anomaly detection model training method for time series data provided in Implementation Method 1. In step 1, the preprocessing includes: performing data standardization, data partitioning, and modality transformation on the time series data.
[0047] Consider a dataset X with N types of data.
[0048] 60% of it was used as training data X t ,
[0049] The middle 20% is used as validation data X v ,
[0050] The last 20% was used as test data X s ,
[0051] Where, x i It represents any one of the data types in the range 1:N of N data types.
[0052] The training and testing parts of the dataset are preprocessed into training and testing parts that can be input into the model.
[0053] Implementation Method 3: This implementation method further defines the training method for the unsupervised anomaly detection model for time series data provided in Implementation Method 1. In step 2, the method for training the detection model is as follows: two low-dimensional embeddings are obtained based on the frequency domain data and the initial time domain data, respectively, and the detection model is trained based on the two low-dimensional embeddings.
[0054] Specifically, including:
[0055] Step 2_1 Let X = (x1, x2, K, x NS is a time series dataset, with the original dataset denoted as S and the perturbed dataset denoted as S'.
[0056] S'={δ(s)|s~S,δ~Ω};
[0057] Where δ represents the perturbation function, s represents the data input to the perturbation function and its range is within S, and Ω represents the magnitude of the perturbation.
[0058] Step 2_2: Perturb the original data according to a certain proportion. Randomly perturb the original data with three types of anomalies: point anomaly, context anomaly, and all anomaly, to generate perturbed data for comparison with the original data.
[0059] Steps 2 and 3 sample the perturbed time series data and the original time series data, and input the two types of data into the upper part of the model for comparative learning. In the lower part, the original time series data and the perturbed time series data are classified and processed. The final result is used to optimize the upper part.
[0060] During the model training phase, the upper part of the model first inputs the perturbed time-series data and the data after feature extraction from the original data into the contrastive learning module. This module uses a cosine distance function to perform anomaly detection. The lower part of the model similarly inputs the perturbed samples and the original samples into a classification task. Finally, the loss result from the classification is fed back into the model for optimization, resulting in better performance.
[0061] Step 2_3 involves inputting the perturbed data and the original data into the model for comparative learning, followed by constraint using a distance function. The calculation formula is as follows:
[0062] Step 2_4 calculates the three types of losses for the original data p and the perturbated data n, making the original data (positive sample) closer to the center a learned by the model, and making the perturbated data farther away from the center a.
[0063] Step 2_5 calculates the upper-half loss using contrastive learning, adding distance constraints to the original formula to change the original Euclidean distance constraint to a non-Euclidean distance constraint. The calculation formula is as follows:
[0064] L=max(d(a,p)-d(a,n)+margin,0);
[0065] Where L represents the distance result, d represents the operation of the distance function, a represents the anchor, the reference sample, p represents the positive sample, the positive sample of the same class as the anchor but different from it, n represents the negative sample, the negative sample of a different class from the reference sample, and margin represents the distance constraint, the distance constraint for positive and negative samples.
[0066] In the second half of step 2_6, the perturbed data and the original data are simultaneously input into the model to calculate the Binary Cross Entropy Loss (BCELoss), which is the binary cross-entropy loss. The calculation formula is as follows:
[0067] L1=(ylog(p(x)+(1-y)log(1-p(x)0);
[0068] Where p(x) is the model output and y is the true label.
[0069] Step 3_5 uses the BCELoss below and the triple loss based on contrastive learning above to jointly optimize the final score and loss.
[0070] Implementation Method 4: This implementation method provides a training device for an unsupervised anomaly detection model for time series data. The device includes:
[0071] Module 1: Used to collect time series data sets of univariate time series, and preprocess the time series data to generate initial time domain data and frequency domain data;
[0072] Module 2: Used to train a detection model based on the frequency domain data and the initial time domain data.
[0073] Implementation Method 5: This implementation method further defines the training device for the unsupervised anomaly detection model of time series data provided in Implementation Method 4. In module 1, the preprocessing includes: performing data standardization, data partitioning, and mode transformation on the time series data.
[0074] Implementation Method Six: This implementation method further defines the time-series data unsupervised anomaly detection model training device provided in Implementation Method Four. In module 2, the specific implementation method for training the detection model is as follows: two low-dimensional embeddings are obtained based on the frequency domain data and the initial time domain data, respectively, and the detection model is trained based on the two low-dimensional embeddings.
[0075] Implementation Method Seven: Combination Figure 4 This embodiment describes an unsupervised anomaly detection method for time-series data, the method comprising:
[0076] Step 3: Train the detection model;
[0077] The training and detection method is the time-series data unsupervised anomaly detection model training method provided in Implementation Method 1;
[0078] Step 4: Verify the detection model. If the verification result meets the preset requirements, proceed to Step 5.
[0079] Step 5: Detect the time series data set according to the detection model.
[0080] Specifically:
[0081] In the model validation and testing phase, after the invention model is trained, the second part of the previously divided dataset is used for validation testing. The purpose is to test the capabilities of the trained model. This invention uses the F1-Score to test and validate the model's capabilities, which is an important criterion for evaluating the invention's quality. Because the training is unsupervised, the dataset is unlabeled; the model acquires the ability to distinguish or label the dataset after training using the features of the dataset itself.
[0082] After the test set test in step 4_1, the validation set is validated using the F1-Score performance metric adopted in this invention, and the maximum value of the validation result is retained.
[0083] After retaining the current maximum value in step 4_2, perform continuous iterative verification until all iterations are completed, and then retain the maximum value.
[0084] Step 4_3 outputs the retained results, then obtains other performance index information and compares it with other models.
[0085] Implementation Method 8: This implementation method provides an unsupervised anomaly detection device for time-series data. The device includes:
[0086] Module 3: Used for training the detection model;
[0087] The training and detection module is the time-series data unsupervised anomaly detection model training device as described in claim 4;
[0088] Module 4: Used to verify the detection model. If the verification result meets the preset requirements, then Module 5 is executed.
[0089] Module 5: Used to perform detection on the time series data set according to the detection model.
[0090] Implementation Method Nine: This implementation method provides a computer storage medium for storing a computer program. The computer program stored in the medium is used to be read by a computer to execute the time-series data unsupervised anomaly detection model training method provided in any one of Implementation Methods One to Three or the time-series data unsupervised anomaly detection method provided in Implementation Method Seven.
[0091] Implementation Method 10: This implementation method provides a computer, including a processor and a storage medium. The storage medium is used to store a computer program. When the processor reads the computer program, the computer executes the time-series data unsupervised anomaly detection model training method provided in any one of Implementation Methods 1 to 3 or the time-series data unsupervised anomaly detection method provided in Implementation Method 7.
[0092] Implementation Method Eleven: This implementation method provides a specific implementation of the unsupervised anomaly detection method for time series data provided in Implementation Method Seven. To verify the advantages and feasibility of the unsupervised anomaly detection method for time series data provided in Implementation Method Seven, the following is specifically described:
[0093] Industrial datasets from computer competitions or other regions were selected. The empty time series information of each dataset has time series characteristics in both the time domain and the frequency domain. The data input was standardized.
[0094] like Figure 1 As shown, this invention provides an unsupervised temporal anomaly detection method based on non-Euclidean support vector domain description, comprising the following steps:
[0095] Step 1 as follows Figure 1 The method flowchart shows that the first step is to input data and process it. The specific steps of data preprocessing are as follows:
[0096] Given time-series data whose features consist of time and frequency domain characteristics, the original data is randomly perturbed using point anomalies, context anomalies, and all anomalies. The perturbed dataset and the original dataset are then fed into a feature extraction network (TCN) for feature extraction.
[0097] Step 1_1 uses the ASD dataset, which contains 119,191 data entries; the Waq dataset, which contains 1,233,143 data entries; and the DSADS dataset, which contains 109,065 data entries.
[0098] After loading in step 1_2, the dataset file is divided.
[0099] Specifically, 60% is used as training data X. t ,
[0100] The middle 20% is used as validation data X v ,
[0101] The last 20% was used as test data X s ,
[0102] Step 1_3 involves data processing, preprocessing all training and testing data in the dataset into training and testing data that the model can input.
[0103] Step 2, the data input stage, is given a time series input, which consists of time domain features and frequency domain features. The data features are perturbed according to a certain ratio to generate negative sample data as perceived by the model. Then, the original data and the perturbed data are simultaneously input into the TCN feature extraction network for feature extraction. Finally, the data is input into the upper and lower parts of the model for training.
[0104] Step 2_1 Let X = (x1, x2, K, x N X is a time series dataset, where x is an ordered sequence of N observations. Each observation in X is a vector described by a D variant. When D > 1, the dataset X is called a multivariate time series; if D = 1, the dataset is reverted to a univariate setting. The original dataset is denoted as S. The perturbed dataset is denoted as S'.
[0105] S'={δ(s)|s~S,δ~Ω};
[0106] Step 2_2: Perturb the original data according to a certain proportion. Randomly perturb the original data with three types of anomalies: point anomaly, context anomaly, and all anomaly. The perturbed data and the original input data are simultaneously input into the TCN feature extraction network for feature extraction.
[0107] Step 2_3 outputs the data after feature extraction, which will be used as the input for the upper and lower models for model training.
[0108] Step 3: Formal model training phase. The formally trained model is as follows: Figure 3 As shown, the dataset is split into training, validation, and test sets in a 6:2:2 ratio. The specific steps are as follows:
[0109] Step 3_1 uses the ASD dataset, which contains 119,191 data entries; the Waq dataset, which contains 1,233,143 data entries; and the DSADS dataset, which contains 109,065 data entries.
[0110] Step 3_2: Input the original data and the perturbed data into the TCN model, extract the features, and then input them into the upper and lower models for training.
[0111] Step 3_3: In the upper part of the model, after inputting positive and negative samples, a triple loss calculation is performed. Using cosine distance constraints, a triple loss calculation for contrastive learning is performed, as shown in the formula below:
[0112] L=max(d(a,p)-d(a,n)+margin,0);
[0113] Step 3_4: In the upper part of the model, after inputting positive and negative samples, BCELoss calculation is performed to generate the classification cross-entropy for positive and negative samples, as shown in the formula below:
[0114] L c =(ylog(p(x)+(1-y)log(1-p(x)0)();
[0115] Among them, L c p(x) represents the final loss result of BCELOSS, y represents the true label, p(x) represents the model output, and x represents the data input.
[0116] Step 3_5: Perform joint data optimization. Combine the upper part (L, where L represents the loss) with the lower part of the model and perform joint optimization to obtain the final loss, which is L. D Total loss, representing the sum of the two losses, is expressed by the formula shown below:
[0117] L D =L c +L
[0118] Among them, L D This represents the sum of the two losses.
[0119] Step 3_9 involves iterative steps to obtain the optimized model.
[0120] Step 4: DSG model testing phase. The model in the testing phase is as follows: Figure 4 As shown, the tests used the ASD and Waq datasets, and ablation experiments were conducted on ASD and Waq.
[0121] Step 4_1 uses different neg_batch_ratios (negative sample perturbation ratio, which means that during the perturbation phase, the proportion of the perturbation part of the dataset is adjusted) to control the size and ratio of the perturbation. The invention is then verified by ablation of the upper and lower halves of the model.
[0122] Step 4_2 involves ablation experiments with different component configurations as follows:
[0123] On the Waq dataset,
[0124] Setting neg_batch_ratio = 0.2 (a perturbation ratio of 0.2, or one-fifth, meaning that the perturbation portion of the overall perturbation is 0.2) represents approximately 20% of the perturbation portion;
[0125] Setting neg_batch_ratio = 0.5 (a perturbation ratio of 0.5, or one-half, meaning that the perturbation portion of the overall perturbation is 0.5) represents approximately 50% of the perturbation portion.
[0126] Setting neg_batch_ratio = 1.0 (the perturbation ratio is 1.0, which means the perturbation ratio in the whole is 1.0) represents approximately 100% of the perturbation ratio.
[0127] In the upper half module, the upper half module does not run, UM = Flase (UM is the name of the upper half model in this invention, as introduced earlier, indicating that the upper half model does not run, and only the calculation of the lower half model AC is performed).
[0128] In the lower half of the module, the lower half of the module does not run, AC = Flase (AC is the name of the lower half model in this invention, as introduced earlier, indicating that the lower half model does not run, and only the calculation of the upper half model UM is performed).
[0129] This is from the PEMS08 dataset (Source: California Highway Network PeMS Traffic Flow Dataset PEMS08 https: / / download.csdn.net / download / weixin_41990278 / 85335477?utm_source=bbsseo);
[0130] The perturbation ratio with neg_batch_ratio set to 0.2 is approximately 20%.
[0131] With neg_batch_ratio set to 0.5, the perturbation ratio is approximately 50%.
[0132] The perturbation ratio with neg_batch_ratio = 1.0 is approximately 100%.
[0133] In the upper half of the module, the upper half of the module does not run, so UM = False;
[0134] In the lower half of the module, the lower half of the module is not executed, AC = False;
[0135] Step 4_3 calculates the Area Under Curve (AUC), F1-Score, and Average Precision (AP) metrics (these metrics are generally accepted in the field; AUC is a model evaluation metric in the field of machine learning) and compares them with the original invention.
[0136] The detection method in this embodiment enhances the robustness of the model by constructing negative samples, introduces classification cross-entropy to correct the anomaly detection results, and uses BCELoss and contrastive learning to constrain anomaly detection, which has shown good results in the field of time series anomaly detection.
[0137] The above description of several specific embodiments further details the technical solution provided by the present invention in order to highlight the advantages and benefits of the technical solution provided by the present invention. However, the above-described specific embodiments are for the purpose of describing the technical solution provided by the present invention in detail and are not intended to limit the present invention. Any reasonable modifications and improvements to the present invention, reasonable combinations of embodiments, and equivalent substitutions based on the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for training an unsupervised anomaly detection model for time-series data, characterized in that, The method includes: Step 1: Collect a set of time series data of univariate time series, and preprocess the time series data to generate initial time domain data and frequency domain data; Step 2: Train the detection model based on the frequency domain data and the initial time domain data; Specifically, Time series data consists of time domain and frequency domain. Then, random perturbation methods are applied to the original data, including point anomalies, context anomalies, and all anomalies. The perturbed dataset and the original dataset are then placed in the feature extraction network TCN for feature extraction. In the data input stage, a time series input is given, which consists of time domain features and frequency domain features. The data features are perturbed according to a certain ratio to generate negative sample data as perceived by the model. Then, the original data and perturbed data are simultaneously input into the TCN feature extraction network for feature extraction. Finally, the data is input into the upper and lower parts of the model for training. During the model training phase, the upper part of the model first inputs the perturbed time series data and the data after feature extraction from the original data into the contrastive learning module. In the contrastive learning module, a cosine distance function is defined and applied to the module to perform anomaly detection. The lower part of the model inputs both the perturbed and original data simultaneously to calculate the Binary CrossEntropy Loss (BCELoss), which is the binary cross-entropy loss; its calculation formula is as follows: ； in It is the model output. It's a real label.
2. The method for training an unsupervised anomaly detection model for time-series data according to claim 1, characterized in that, In step 1, the preprocessing includes: performing data standardization, data partitioning, and modality transformation on the time series data.
3. The method for training an unsupervised anomaly detection model for time-series data according to claim 1, characterized in that, In step 2, the method for training the detection model is as follows: two low-dimensional embeddings are obtained based on the frequency domain data and the initial time domain data, respectively, and the detection model is trained based on the two low-dimensional embeddings.
4. A training device for an unsupervised anomaly detection model for time-series data, characterized in that, The device includes: Module 1: Used to collect time series data sets of univariate time series, and preprocess the time series data to generate initial time domain data and frequency domain data; Module 2: Used to train a detection model based on the frequency domain data and the initial time domain data; Specifically, Time series data consists of time domain and frequency domain. Then, random perturbation methods are applied to the original data, including point anomalies, context anomalies, and all anomalies. The perturbed dataset and the original dataset are then placed in the feature extraction network TCN for feature extraction. In the data input stage, a time series input is given, which consists of time domain features and frequency domain features. The data features are perturbed according to a certain ratio to generate negative sample data as perceived by the model. Then, the original data and perturbed data are simultaneously input into the TCN feature extraction network for feature extraction. Finally, the data is input into the upper and lower parts of the model for training. During the model training phase, the upper part of the model first inputs the perturbed time series data and the data after feature extraction from the original data into the contrastive learning module. In the contrastive learning module, a cosine distance function is defined and applied to the module to perform anomaly detection. The lower part of the model inputs both the perturbed and original data simultaneously to calculate the Binary CrossEntropy Loss (BCELoss), which is the binary cross-entropy loss; its calculation formula is as follows: ； in It is the model output. It's a real label.
5. The training apparatus for an unsupervised anomaly detection model for time-series data according to claim 4, characterized in that, In module 1, the preprocessing includes: performing data standardization, data partitioning, and mode transformation on the time-series data.
6. The training apparatus for an unsupervised anomaly detection model for time-series data according to claim 4, characterized in that, In module 2, the specific implementation method for training the detection model is as follows: two low-dimensional embeddings are obtained based on the frequency domain data and the initial time domain data, respectively, and the detection model is trained based on the two low-dimensional embeddings.
7. An unsupervised anomaly detection method for time-series data, characterized in that, The method includes: Step 3: Train the detection model; The training and detection method is the time-series data unsupervised anomaly detection model training method as described in claim 1; Step 4: Verify the detection model. If the verification result meets the preset requirements, proceed to Step 5. Step 5: Detect the time series data set according to the detection model.
8. A time-series data unsupervised anomaly detection device, characterized in that, The device includes: Module 3: Used for training the detection model; The training and detection module is the time-series data unsupervised anomaly detection model training device as described in claim 4; Module 4: Used to verify the detection model. If the verification result meets the preset requirements, then Module 5 is executed. Module 5: Used to perform detection on the time series data set according to the detection model.
9. A computer storage medium for storing computer programs, characterized in that, The computer program stored in the medium is used to be read by a computer to execute the time-series data unsupervised anomaly detection model training method according to any one of claims 1-3 or the time-series data unsupervised anomaly detection method according to claim 7.
10. A computer, comprising a processor and a storage medium, said storage medium for storing a computer program, characterized in that, When the processor reads the computer program, the computer executes the time-series data unsupervised anomaly detection model training method according to any one of claims 1-3 or the time-series data unsupervised anomaly detection method according to claim 7.