A multi-element time series anomaly detection method and system based on weakly supervised integration

Abstract

This paper presents a multivariate time series anomaly detection method and system based on weakly supervised ensemble. Specifically, it addresses the problems of poor anomaly detection performance, low accuracy, high labor costs, and difficulty in adapting to changes in business and product characteristics associated with traditional time series anomaly detection methods. The method utilizes different time series anomaly detection algorithms to detect anomalies in a training set, obtaining corresponding anomaly scores. It then extracts the correlation between any two time series in the training set to obtain correlation features. The anomaly scores and corresponding correlation features of each multivariate time series are combined as new features for the current multivariate time series. The XGBoost algorithm is then used to perform anomaly detection on these new features, outputting whether the corresponding multivariate time series is an anomaly, thus obtaining an anomaly detector. This anomaly detector is then used to directly detect anomalies in the multivariate time series. This falls under the field of sequence anomaly detection.

Description

Technical Field

[0001] This invention relates to a method and system for detecting time series anomalies, specifically a multivariate time series anomaly detection method and system based on weakly supervised ensemble, belonging to the field of sequence anomaly detection. Background Technology

[0002] Anomaly detection is one of the most mature applications in time series data analysis. It is defined as the process of identifying abnormal events or behaviors from normal time series data. Effective time series anomaly detection is widely used in many fields, such as quantitative trading, server network security testing, autonomous driving, and routine maintenance of large industrial equipment.

[0003] Currently, commonly used time series anomaly detection methods include Metis, XGBOD, Ymir, and HoloClean. While Metis offers intelligent detection based on dynamic thresholds, alleviating the heavy reliance on developers and operations personnel, its unsupervised approach is overly simplistic. It requires setting very low thresholds for anomaly scores to output as many suspected anomalies as possible, leading to a situation where most of the time series data is suspected of being anomalies. This means the unsupervised detection portion doesn't actually contribute much to the anomaly detection process. Furthermore, Metis's performance significantly degrades when dealing with industrial time series data containing numerous domain rules. XGBOD uses anomaly scores from multiple unsupervised anomaly detection algorithms as new features of the original dataset and utilizes these features as training data for a new supervised model. This fully leverages the features of the original data. However, the training dataset used in this method must be entirely based on manual annotation, requiring high-quality annotations. Moreover, the unsupervised anomaly detection algorithms used are traditional machine learning methods, lacking specificity for the time series characteristics of the data. The Ymir method is an improved version of the XGBOD method specifically designed for anomaly detection in time series data. However, apart from replacing the unsupervised method with an anomaly detection method for time series, it still relies on the quality of manually labeled training datasets. It is difficult to achieve effective detection in environments lacking manual labeling. Furthermore, this method has only been uploaded to arXiv and has not been formally published, thus lacking verification of its effectiveness and practicality.

[0004] In summary, existing time series anomaly detection methods either suffer from poor unsupervised detection performance and low detection efficiency when dealing with large amounts of industrial time series data, resulting in poor anomaly detection results and low accuracy, or require training datasets entirely based on high-quality manual annotations. Furthermore, unsupervised anomaly detection algorithms lack specificity for the temporal characteristics of time series data, leading to high labor costs and difficulty in adapting to changes in business and product characteristics. Summary of the Invention

[0005] To address the problems of unsupervised anomaly detection methods having limited effectiveness and poor performance when dealing with large amounts of industrial time-series data, resulting in poor anomaly detection results and low accuracy, as well as the requirement that training datasets be entirely based on high-quality manual annotations and the lack of specificity of unsupervised anomaly detection algorithms to the temporal characteristics of time-series data, leading to high labor costs and difficulty in adapting to changes in business and product characteristics, this invention proposes a multivariate time-series anomaly detection method and system based on weakly supervised ensemble.

[0006] The technical solution adopted in this invention is:

[0007] It includes the following steps:

[0008] S1. Obtain a multivariate time series of several power grid oil chromatography data, perform data augmentation on the multivariate time series, automatically generate abnormal time series that violate different constraint types, and if the abnormal time series is a part of the obtained multivariate time series, then the remaining multivariate time series is used as the normal time series. Based on the abnormal time series and the normal time series, a training set with an abnormal proportion balance is obtained.

[0009] Data augmentation is performed on multivariate time series data to automatically generate anomalous time series that violate different constraint types, specifically:

[0010] The ratio of hydrogen concentration to methane concentration in the power grid oil chromatographic data must never exceed 7. By setting the ratio of hydrogen concentration to methane concentration to exceed 7 according to data augmentation, the resulting multivariate time series is the abnormal oil chromatographic data.

[0011] S2. Use different time series anomaly detection algorithms to detect anomalies in the training set and obtain the anomaly score of each multivariate time series under each time series anomaly detection algorithm.

[0012] S3. Use the CoFlux coefficient as a metric to extract the correlation between any two time series in the training set, convert the correlation into a vector, and obtain the correlation features.

[0013] S3 further includes:

[0014] A linear model of the two time series is constructed based on the correlation between them. A function of the two time series is obtained based on the linear model, and the function is used as a constraint rule for constrained anomaly detection.

[0015] S4. Merge the outlier scores and corresponding correlation features of each multivariate time series as the new features of the current multivariate time series;

[0016] S5. Input the new features of each multivariate time series into the XGBoost algorithm for training, and output whether the corresponding multivariate time series is an anomalous time series until the accuracy of the detection results remains basically unchanged, and obtain the trained anomaly detector.

[0017] S6. Obtain the multivariate time series to be detected, input the multivariate time series into the trained anomaly detector, and output whether the corresponding multivariate time series is an anomalous time series.

[0018] Furthermore, the different constraint types in S1 include negation constraints, velocity constraints, and acceleration constraints.

[0019] Furthermore, the different time series anomaly detection algorithms in S2 include seasonal anomaly detection, trend anomaly detection, pattern anomaly detection, distance anomaly detection, and constraint anomaly detection.

[0020] Furthermore, the method for extracting the correlation between any two time series in S3 also includes the Pearson coefficient or the DTW coefficient.

[0021] A multivariate time series anomaly detection system based on weakly supervised ensemble includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any step of a multivariate time series anomaly detection method based on weakly supervised ensemble.

[0022] A computer-readable storage medium storing a computer program that, when executed by a processor, implements any step of a multivariate time series anomaly detection method based on weakly supervised ensemble.

[0023] Beneficial effects:

[0024] This invention constructs a training set with a balanced anomaly ratio, resulting in better training performance for multivariate time series anomaly detection. Different time series anomaly detection algorithms are used to detect anomalies on the training set, obtaining anomaly scores for each multivariate time series under each algorithm. This allows for the acquisition of features or information about the multivariate time series under different constraints. The correlation between any two time series in the training set is extracted to obtain correlation features. CoFlux coefficient-based correlation feature extraction is simultaneously incorporated into the unsupervised anomaly detection process to uncover associations between anomalies across multiple time series. These associations are quantified to obtain correlations, improving the unsupervised detection performance. The anomaly score and corresponding correlation features of each multivariate time series are merged to form a new feature for the current multivariate time series. Thus, for massive time series data in the industrial field, the correlation between time series data and the features or information of each time series under different constraints are used to automatically generate constraints for proactive annotation, eliminating the need for manual annotation, saving labor costs, and the new features can encompass most of the temporal characteristics of the time series data. The new features of each multivariate time series are input into the XGBoost algorithm for training, and the algorithm outputs whether the corresponding multivariate time series is an anomalous time series. This process is repeated until the accuracy of the detection results remains basically unchanged, resulting in a trained anomaly detector. The anomaly detector is then used to directly detect multivariate time series. In this way, it is targeted to different time series features of time series data, which can adapt to changes in business and product characteristics, and at the same time improve the anomaly detection effect and accuracy. Attached Figure Description

[0025] Figure 1 This is a flowchart of the present invention; Detailed Implementation

[0026] Specific implementation method one: Combining Figure 1 This embodiment describes a multivariate time series anomaly detection method based on weakly supervised ensemble, which includes the following steps:

[0027] S1. Obtain a multivariate time series of several power grid oil chromatography data, perform data augmentation on the multivariate time series, and automatically generate abnormal time series that violate different constraint types, including negation constraints, velocity constraints, and acceleration constraints. If the abnormal time series is a part of the obtained multivariate time series, then the remaining multivariate time series is used as the normal time series. A training set with an abnormal proportion balance is obtained based on the abnormal time series and the normal time series.

[0028] The purpose of data augmentation is to generate non-compliant power grid oil chromatographic data from user-provided, unlabeled (whether it is an anomalous time series) power grid oil chromatographic data based on existing rules. This allows for the automatic generation of anomalous labels on the non-compliant data, effectively generating multiple types of anomalies without requiring manual annotation by the user. This provides richer training data for the invention, achieving a weakly supervised effect. The existing rules are transformer fault identification and judgment methods in power grid data, namely the three-ratio method. This method determines nine fault states by observing whether the concentration ratio of three sets of monitored gases in the transformer exceeds a given range: no fault, low-temperature overheating, medium-temperature overheating, high-temperature overheating, partial discharge, low-energy discharge, low-energy discharge combined with overheating, arc discharge, and arc discharge combined with overheating. Data augmentation ensures the balance of the training power grid oil chromatographic data and enhances the F1 score of the anomaly detector. The data augmentation strategy is to learn a model that generates anomalous data that is as far removed from the correct data as possible, thereby augmenting relational data. For example, the original correct time series is Queen Street, but the data augmentation model can generate King Street as an anomalous time series and automatically mark it as an anomalous time series, adding it to the original training set. In this way, a small training set can be expanded to contain enough anomalous time series so that the supervised anomaly detector can learn the features of anomalous time series. Specifically, one rule of the power grid oil chromatography dataset is that the ratio of hydrogen concentration to methane concentration in the oil chromatography data must never exceed 7. Mathematically, this translates to... Based on data augmentation, the ratio of hydrogen concentration to methane concentration was set to exceed 7, resulting in... Multivariate time series data, i.e., abnormal oil chromatographic data.

[0029] Negation constraints, velocity constraints, and acceleration constraints are all existing constraint types. The acceleration constraint originates from "Stream Data Cleaning under Speed ​​and Acceleration Constraints." Anomaly imbalance refers to a situation where there are too few anomalous labels in the training data, causing the model to learn patterns from normal data only, thus failing to effectively detect diverse anomaly patterns. Anomaly balance means that the number of anomalous labels and normal labels in the training dataset is close, thus providing a more accurate representation of the model's training performance.

[0030] Before using the training set as input to the supervised model, this invention designs a data augmentation method for time series data. Based on the features learned by the unsupervised anomaly detector, it can generate an additional training set with anomaly labels, so that even when the labeled training samples are small, this invention can still adequately train the supervised model.

[0031] S2. Use existing time series anomaly detection algorithms to detect anomalies in the training set and obtain the anomaly score of each multivariate time series under each time series anomaly detection algorithm.

[0032] Different time series anomaly detection algorithms include seasonal anomaly detection, trend anomaly detection, pattern anomaly detection, distance anomaly detection, and constraint anomaly detection.

[0033] Seasonal and Trend Anomaly Detection: For seasonal and trend anomaly detection, we employ the STL decomposition technique, which represents a Loess-based seasonal trend decomposition process. This technique decomposes time series data into a summative or multiplicative summation of three series: a seasonal series, a trend series, and a residual series. Therefore, peak detection can be performed on the residual series for both the seasonal and trend series to identify corresponding anomalies.

[0034] Pattern Anomaly Detection: For pattern anomaly detection, we use a reconstructed deep model, where the deep model directly learns some of the core features of the data to be detected and uses these core features to regenerate the original data. By performing peak detection on the residual between the generated time series and the original time series, we can discover anomalous data.

[0035] Distance anomaly detection: The distance anomaly detection we use is the classic machine learning model—kNN algorithm. This algorithm sorts the time series data by calculating the distance between the data values ​​at each time point, and determines the threshold of the distance between abnormal data and normal data based on the percentage of distance, and judges anomalies based on this threshold.

[0036] Constraint anomaly detection defines constraints related to domain knowledge. It determines whether data anomalies exist by detecting whether multivariate time series data violate the given constraints. The most common constraint types include negation constraints, velocity constraints, and acceleration constraints.

[0037] S3. Using Pearson coefficient, DTW coefficient, or CoFlux coefficient as metrics, extract the correlation between any two time series of power grid oil chromatography data in the training set. Convert the correlation into a vector to obtain correlation features. Construct a linear model of the two time series based on their correlation. Then, convert the correlation between the two series into a time series constraint form, i.e., obtain a function of the two time series based on the linear model. Use this function as a constraint rule for anomaly detection in the next multivariate time series data analysis of power grid oil chromatography. For example, if time series A and time series B of power grid oil chromatography satisfy a linear relationship of A = 2B + k, then convert it into the function: A ≤ 2B + K. max and A≥2B+Kmin This allows for dynamic updates of constraints to adapt to changes in the time series.

[0038] This invention incorporates CoFlux coefficient-based correlation feature extraction into the unsupervised anomaly detection process. This process uncovers associations between anomalies across multiple time series, quantifies these associations to obtain correlations, and then adds the CoFlux coefficient as a new feature to the training set of the subsequent supervised model. The CoFlux coefficient is based on the idea that for any time series data, there is always a suitable unsupervised anomaly detection model that can relatively accurately extract its volatility characteristics, and if two time series are correlated with volatility, their volatility characteristic sequences should also be correlated. Therefore, the anomaly detection model can be used to extract the volatility characteristic sequences of time series, and the correlation of these volatility characteristic sequences can be used instead of directly calculating the correlation between two time series.

[0039] The advantage of this step is that industrial time series datasets often contain a large number of correlations. These relationships can often be converted into mutual constraints of attributes within a certain interval. These constraints can often be used to detect whether multiple sequences exhibit anomalies simultaneously. In addition, there are causal relationships between sequences in time order. If a sequence exhibits an anomaly, sequences causally related to it will also exhibit similar anomalies at the corresponding time points.

[0040] S4. Since the anomaly score in S2 is a score for the data at each timestamp of the time series of the power grid oil chromatography data, the anomaly score itself can also be regarded as a time series. Moreover, this score series is highly correlated with the degree of anomaly of the time series itself, and therefore can be regarded as a new feature of the multivariate time series. Therefore, this invention merges the anomaly score and the corresponding correlation feature of the multivariate time series of each power grid oil chromatography data as a new feature of the current multivariate time series of the power grid oil chromatography data. The purpose of this step is to use the training set again to autonomously generate anomaly labels for the multivariate time series to be detected, without requiring users to perform complex and tedious manual input, thus saving the cost of anomaly detection.

[0041] S5. Input the new features of the multivariate time series of each power grid oil chromatography data into the XGBoost algorithm for training. Output whether the corresponding multivariate time series is an anomalous time series. If it is an anomalous time series, generate the corresponding anomaly detection report. Continue until the accuracy of the detection results remains basically unchanged, and obtain the trained anomaly detector. This anomaly detector has a stronger anomaly detection capability.

[0042] The XGBoost algorithm continuously selects attributes from the time series as tree splits, ultimately generating a decision tree. Each branch of this decision tree judges multiple attribute values ​​in the time series, ultimately determining whether the attribute value at each time point in the time series is classified as anomalous or normal data. This can be understood as follows: each training round of the XGBoost method generates an anomaly detector that determines anomalies based on the interval containing a single attribute value; these anomaly detectors are then connected to generate a strong anomaly detector capable of determining anomalies based on combinations of multiple attribute values.

[0043] This invention combines unsupervised and supervised algorithms (XGBoost method) to improve accuracy and speed up detection.

[0044] S6. Obtain the multivariate time series of the power grid oil chromatographic data to be detected, input the multivariate time series into the trained anomaly detector, and output whether the corresponding multivariate time series is an anomalous time series.

[0045] Specific Implementation Method Two: Combining Figure 1 This embodiment describes a multivariate time series anomaly detection system based on weakly supervised ensemble, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any step of a multivariate time series anomaly detection method based on weakly supervised ensemble.

[0046] Specific implementation method three: Combining Figure 1 This embodiment describes a computer-readable storage medium storing a computer program that, when executed by a processor, implements any step of a multivariate time series anomaly detection method based on weakly supervised ensemble.

Claims

1. A multivariate time series anomaly detection method based on weakly supervised ensemble, characterized in that: It includes the following steps: S1. Obtain a multivariate time series of several power grid oil chromatography data, perform data augmentation on the multivariate time series, automatically generate abnormal time series that violate different constraint types, and if the abnormal time series is a part of the obtained multivariate time series, then the remaining multivariate time series is used as the normal time series. Based on the abnormal time series and the normal time series, a training set with an abnormal proportion balance is obtained. Data augmentation is performed on multivariate time series data to automatically generate anomalous time series that violate different constraint types, specifically: The ratio of hydrogen concentration to methane concentration in the power grid oil chromatographic data must never exceed 7. By setting the ratio of hydrogen concentration to methane concentration to exceed 7 according to data augmentation, the resulting multivariate time series is the abnormal oil chromatographic data. S2. Use different time series anomaly detection algorithms to detect anomalies in the training set and obtain the anomaly score of each multivariate time series under each time series anomaly detection algorithm. S3. Use the CoFlux coefficient as a metric to extract the correlation between any two time series in the training set, convert the correlation into a vector, and obtain the correlation features. S3 further includes: A linear model of the two time series is constructed based on the correlation between them. A function of the two time series is obtained based on the linear model, and the function is used as a constraint rule for constrained anomaly detection. S4. Merge the outlier scores and corresponding correlation features of each multivariate time series as the new features of the current multivariate time series; S5. Input the new features of each multivariate time series into the XGBoost algorithm for training, and output whether the corresponding multivariate time series is an anomalous time series until the accuracy of the detection results remains basically unchanged, and obtain the trained anomaly detector. S6. Obtain the multivariate time series to be detected, input the multivariate time series into the trained anomaly detector, and output whether the corresponding multivariate time series is an anomalous time series.

2. The multivariate time series anomaly detection method based on weakly supervised ensemble as described in claim 1, characterized in that: The different constraint types in S1 include negation constraints, velocity constraints, and acceleration constraints.

3. The multivariate time series anomaly detection method based on weakly supervised ensemble as described in claim 2, characterized in that: The different time series anomaly detection algorithms in S2 include seasonal anomaly detection, trend anomaly detection, pattern anomaly detection, distance anomaly detection, and constraint anomaly detection.

4. The multivariate time series anomaly detection method based on weakly supervised ensemble as described in claim 3, characterized in that: The method for extracting the correlation between any two time series in S3 also includes the Pearson coefficient or the DTW coefficient.

5. A multivariate time series anomaly detection system based on weakly supervised ensemble, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1-4.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-4.

Images