Multivariate time series data anomaly event diagnosis method, device and equipment and storage medium

Abstract

The application provides a multivariate time series data anomaly event diagnosis method, comprising: preprocessing original data in the multivariate time series to obtain a multivariate time series at each time; fusing time encoding, numerical encoding and position encoding obtained according to the multivariate time series at each time to obtain a feature encoding sequence; inputting the feature encoding sequence into an Informer prediction model to obtain a prediction value at each time; obtaining an anomaly score according to a prediction error obtained by comparing the prediction value with a true value at the corresponding time; comparing the anomaly score with a preset threshold to obtain an anomaly detection result; calculating a root cause score vector according to an abnormal event determined according to the anomaly detection result, and diagnosing an abnormal index causing the abnormal event based on the root cause score vector. The application extracts the time characteristics of the time series data through time encoding embedding, determines the detected continuous abnormal time points as the abnormal event, and improves the detection efficiency and diagnosis accuracy of the multivariate time series.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly diagnosis, and particularly relates to a multi-element time series data anomaly event diagnosis method, device, equipment and storage medium. BACKGROUND

[0002] GTA (Graph Learning with Transformer for Anomaly detection, multi-element time series anomaly detection framework based on Transformer and graph learning) designs a directed graph structure learning strategy, takes a single time series as a node in the graph, and takes the hidden relationship to be discovered between nodes as an edge in the graph, so as to learn a graph structure describing the relationship between time series. The learned graph structure is input into a graph convolution layer for information propagation modeling, and then the graph convolution layer and an extended convolution layer of different levels are integrated together to construct a hierarchical context encoding block specially for time data. The context encoding and position encoding of the multi-element time series data are taken as the input of the Transformer, and the output of the Transformer is the predicted single-step time series value. The second norm of the difference between the time series prediction value and the true value is used to detect and diagnose the abnormal time series.

[0003] GTA adds a graph learning module and an anomaly detection module on the basis of Informer (Beyond Efficient Transformer for Long Sequence Time-Series Forecasting, multi-element long time series prediction framework based on Transformer), and can perform anomaly detection on multi-element time series data. However, the model is relatively complex, the training cost is large, and only the abnormal time points in the multi-element time series can be detected, and the abnormal events of the multi-element time series and the specific indicators causing the abnormality cannot be detected.

[0004] Therefore, how to improve the detection efficiency and diagnosis accuracy of the multi-element time series has become a problem to be solved.

[0005] The above information disclosed in the background art is only used to strengthen the understanding of the background of the present application, and therefore it can contain information which does not form the prior art known to those skilled in the art. SUMMARY

[0006] The present application provides a multi-element time series data anomaly event diagnosis method, device, equipment and storage medium to solve the problems existing in the prior art.

[0007] In a first aspect, the present application provides a multi-element time series data anomaly event diagnosis method, comprising the following steps:

[0008] S1, preprocessing original data in a multi-element time sequence to obtain a multi-element time sequence at each time;

[0009] S2, obtaining time encoding, numerical encoding and position encoding at each time according to the multi-element time sequence at each time, and fusing the time encoding, numerical encoding and position encoding to obtain a feature encoding sequence;

[0010] S3, inputting the feature encoding sequence into an Informer prediction model to obtain a predicted value at each time through the Informer prediction model;

[0011] S4, comparing the predicted value with a true value at a corresponding time to obtain a prediction error at each time, and calculating an anomaly score of data at each time according to the prediction error;

[0012] S5, comparing the anomaly score with a preset threshold to obtain an anomaly detection result of data at each time according to a comparison result;

[0013] S6, calculating a root cause score vector according to an anomaly event determined by the anomaly detection result, and diagnosing an abnormal index causing the anomaly event based on the root cause score vector.

[0014] In some embodiments, the S2 comprises:

[0015] S21, extracting time features and space features in the multi-element time sequence at each time to obtain time encoding values and position encoding values;

[0016] S22, obtaining a numerical encoding corresponding to each time by convolving the multi-element time sequence at each time;

[0017] S23, expanding the time encoding values and the position encoding values to obtain time encoding and position encoding with the same dimension as the numerical encoding;

[0018] S24, adding the numerical encoding, the time encoding and the position encoding to obtain a feature encoding sequence.

[0019] In some embodiments, a specific calculation formula of the time encoding value is:

[0020]

[0021]

[0022]

[0023] wherein h t is a hour encoding value, m t is a minute encoding value, and s tThe value is encoded in seconds, TimeStamp. t The table contains timestamp data at time t. These represent the hour, minute, and second information in the timestamp data, respectively.

[0024] The formula for the numerical encoding is:

[0025] V t =Conv(X t )

[0026] Among them, V t For numerical encoding, X t For the convolution of the multivariate time series at time t;

[0027] The formula for calculating the location code value is:

[0028]

[0029] Where, p t The location-coded value, pos t For numerical encoding V t The absolute position within the entire time series window.

[0030] In some embodiments, S6 includes:

[0031] S61. Determine the abnormal event based on the anomaly detection results;

[0032] S62. Based on the abnormal events, obtain the corresponding abnormal score matrix;

[0033] S63. In the time dimension, the abnormal score matrix is ​​summed to obtain the root cause score vector, which includes the root cause score corresponding to each indicator.

[0034] S64. Sort the results according to the root factor scores to obtain the sorting results;

[0035] S65. Based on the ranking results, the indicators corresponding to the selected root cause scores are diagnosed as abnormal indicators.

[0036] In some embodiments, the preprocessing includes normalization and sliding window partitioning.

[0037] In some embodiments, S4 includes:

[0038] S41. Based on the difference between the actual value and the predicted value at each time point, the prediction error at each time point is obtained;

[0039] S42, mean-variance normalization processing is performed on the prediction errors of each time point to obtain an anomaly score matrix based on each index at each time point;

[0040] S43, according to the anomaly score matrix, an anomaly score of each index at a single time point is obtained;

[0041] S44, among the anomaly scores of each index at the single time point, the maximum anomaly score is taken as the anomaly score of the time point.

[0042] In some embodiments, the calculation formula of the prediction error is:

[0043]

[0044] Wherein, Err i (t) is the prediction error of index i at time t, x t is the true value at time t, is the predicted value at time t;

[0045] The calculation formula of the anomaly score is:

[0046]

[0047] Wherein, s i (t) is the anomaly score, μ i is the mean of Err i , σ i is the variance of Err i .

[0048] Secondly, the application provides a multi-element time series data anomaly event diagnosis device, the device comprises:

[0049] A preprocessing module is configured to preprocess original data in multi-element time series to obtain multi-element time series at each time point;

[0050] A fusion module is configured to extract time features of the multi-element time series at each time point, obtain time encoding, numerical encoding and position encoding according to the time features, and fuse the time encoding, numerical encoding and position encoding to obtain a feature encoding sequence;

[0051] A time series prediction module is configured to input the feature encoding sequence into an Informer prediction model to obtain predicted values at each time point through the Informer prediction model;

[0052] An anomaly score calculation module is configured to compare the predicted values with true values at corresponding time points to obtain prediction errors at each time point, and calculate anomaly scores of data at each time point according to the prediction errors;

[0053] an anomaly detection module configured to compare the anomaly score with a preset threshold, and obtain an anomaly detection result of the data at each time point according to a comparison result;

[0054] an anomaly diagnosis module configured to calculate a root cause score vector according to an anomaly event determined based on the anomaly detection result, and diagnose an abnormal index causing the anomaly event based on the root cause score vector.

[0055] In a third aspect, the present application provides a terminal device, comprising:

[0056] a memory configured to store a computer program;

[0057] a processor configured to read the computer program in the memory and perform operations corresponding to the multi-element time series data anomaly event diagnosis method.

[0058] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the multi-element time series data anomaly event diagnosis method.

[0059] The method, apparatus, device, and storage medium for diagnosing anomalies in multivariate time-series data provided in this application include the following steps: S1, preprocessing the raw data in the multivariate time series to obtain multivariate time series at each time point; S2, obtaining time codes, numerical codes, and position codes at each time point based on the multivariate time series at each time point, and fusing the time codes, numerical codes, and position codes to obtain a feature coding sequence; S3, inputting the feature coding sequence into an Informer prediction model to obtain predicted values ​​at each time point; S4, comparing the predicted values ​​with the actual values ​​at the corresponding time points to obtain the prediction errors at each time point, and calculating anomaly scores for the data at each time point based on the prediction errors; S5, comparing the anomaly scores with a preset threshold to obtain anomaly detection results for the data at each time point based on the comparison results; S6, calculating root cause score vectors for the anomaly events determined by the anomaly detection results, and diagnosing the anomaly indicators causing the anomaly events based on the root cause score vectors. This application identifies anomalous events by processing multivariate time-series data through multiple steps, including preprocessing, encoding embedding, time-series prediction, anomaly score calculation, anomaly detection, and anomaly diagnosis. Data preprocessing normalizes the original data and divides it into multivariate time series using a sliding window method. The encoding embedding part extracts temporal features from the preprocessed data and merges these features with the original data to obtain new data. In the time-series prediction part, the data is input into the Informer prediction model, and the output is the predicted value for the corresponding time point. The anomaly score calculation part compares the predicted value with the true value to obtain the prediction error, and then calculates the anomaly score for each time point. The threshold selection part compares a preset threshold with the anomaly score to obtain the anomaly detection result for each time point. By extracting temporal features from the time-series data through time encoding embedding, the accuracy of anomaly diagnosis is improved while ensuring the accuracy and efficiency of anomaly detection. Detected consecutive anomalous time points are identified as anomalous events, improving the detection efficiency and diagnostic accuracy of multivariate time series. Attached Figure Description

[0060] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0061] Figure 1 A schematic diagram of the multivariate time-series data anomaly event diagnosis method provided in this application;

[0062] Figure 2 A schematic diagram of abnormal time points and abnormal events in the multivariate time series data anomaly event diagnosis method provided in this application;

[0063] Figure 3A schematic diagram of a sliding window involved in the multi-variate time series data anomaly event diagnosis method provided in the present application;

[0064] Figure 4 A schematic diagram of an encoding embedding involved in the multi-variate time series data anomaly event diagnosis method provided in the present application;

[0065] Figure 5 A schematic diagram of an Informer prediction model involved in the multi-variate time series data anomaly event diagnosis method provided in the present application;

[0066] Figure 6 A schematic diagram of an anomaly score calculation involved in the multi-variate time series data anomaly event diagnosis method provided in the present application;

[0067] Figure 7 A schematic diagram of an anomaly diagnosis involved in the multi-variate time series data anomaly event diagnosis method provided in the present application.

[0068] Through the above-mentioned drawings, the specific embodiments of the present application have been shown, and will be described in more detail hereinafter. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0069] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0070] The terms used in the embodiments of the present application are merely for the purpose of describing specific embodiments and are not intended to limit the present application. The singular forms "a", "an" and "the" used in the embodiments of the present application are also intended to include the plural forms unless the context clearly indicates otherwise.

[0071] In addition, the terms "first", "second" are only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple", "several" is two or more, unless otherwise specifically limited.

[0072] It is to be understood that the structures, proportions, sizes, etc. shown in the drawings of the present disclosure are merely intended to facilitate the understanding of the present disclosure, and are not intended to limit the conditions under which the present disclosure can be implemented. Therefore, any modification, change or adjustment of the structures, proportions or sizes, which does not affect the effects and purposes of the present disclosure, shall still fall within the scope of the present disclosure.

[0073] It should be understood that the term "and / or" used herein is merely a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents an "or" relationship between the associated objects before and after it.

[0074] Depending on the context, the word "if" as used herein can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if determined" or "if detecting (a stated condition or event)" can be interpreted as "when determined" or "in response to determining" or "when detecting (a stated condition or event)" or "in response to detecting (a stated condition or event)".

[0075] It should also be noted that the term "comprising" or "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that the product or system including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such product or system. Without more limitations, the element defined by the sentence "including a" does not exclude the presence of another identical element in the product or system including the element.

[0076] Detailed analysis of the background problem:

[0077] Most of the current work on anomaly detection is only to detect the time point of the anomaly. However, in actual industrial production process, the occurrence of anomaly is not only a time point, but also may last for a period of time. The present application refers to a continuous anomaly time point as an anomaly event, which is often caused by the same fault and caused by one or more sensors. Figure 2 The schematic diagram of anomaly time point and anomaly event in the multivariate time series data anomaly event diagnosis method provided by the present application is shown in Figure 2 Therefore, the anomaly diagnosis not only detects the anomaly event, but also diagnoses the specific sensor causing the anomaly or the index generated by the sensor. In the anomaly diagnosis of the present application, the sensor and the index are equivalent.

[0078] GTA regards each time sequence in the time window as a node in the graph, and the hidden relationship to be discovered between the nodes as an edge in the graph, thereby learning a graph structure describing the relationship between the time sequences. Based on the learned graph structure, information propagation is modeled by using graph convolution, and then these graph convolution layers are integrated with expansion convolution layers at different levels to construct a hierarchical context encoding block specially for time data. The context encoding block makes the anomaly detection model too complex, resulting in long model training time and low anomaly detection efficiency. Moreover, the context encoding block confuses the features between different sensors, and although the confused features can detect abnormal time points, it is difficult to diagnose the indicators causing the abnormal events from the confused features, which leads to low anomaly diagnosis accuracy of GTA.

[0079] Detecting and diagnosing abnormal events in multi-element time series is an effective method for performance reliability guarantee, and is also the basis for further rapid loss-making, fault root cause analysis. The efficiency of anomaly detection and the accuracy of diagnosis are of great significance to realize network situation intelligent perception and intelligent operation and maintenance. Therefore, improving the detection efficiency and diagnosis accuracy of multi-element time series is a problem that needs to be solved at present.

[0080] Explanation of professional terms:

[0081] Informer aims to apply the Transformer architecture to the field of multi-element time series prediction, and improves the Transformer architecture, and proposes an efficient Transformer-based model Informer. Specifically, Informer designs a ProbSparse self-attention mechanism and a distillation operation to deal with the challenges of quadratic time complexity and quadratic memory usage in ordinary Transformers. In addition, a carefully designed generative decoder alleviates the limitations of the traditional encoder-decoder architecture. Experiments on real data verify the effectiveness of the method in improving the prediction ability of long time series prediction problems.

[0082] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0083] In the present application, the given original data X={x1,x2,…,x T}∈R T×m , T is the time length, and m is the dimension of the multi-element time series. x t ∈R m represents the data at time t, represents the value of the i-th indicator at time t. Multivariate time series anomaly detection and diagnosis are performed on the original data to obtain a label sequence Y = {y1, y2, …, yT} E R T}∈R T×1 , the label y t = 1 indicates that the time point t is abnormal.

[0084] Figure 1 A schematic diagram of the multivariate time series data anomaly event diagnosis method provided in the embodiments of the present application is shown in FIG. 1. As shown in FIG. 1, the multivariate time series data anomaly event diagnosis method provided in the present application comprises the following steps: Figure 1

[0085] S1, pre-processing the original data in the multivariate time series to obtain a multivariate time series at each time point;

[0086] It should be noted that the original data set used may contain missing values in the collection process. Before inputting the data into the model, the missing values need to be filled in to avoid possible problems during training. In the present application, the missing data part in the data set is filled with the previous non-missing value of the data.

[0087] The data of each dimension in the data set is the data collected on different sensors, and the numerical values often have different dimensions. In order to avoid the effect of different dimensions of data on the effect of model training, it is necessary to perform data normalization processing.

[0088] Specifically, in the embodiments of the present application, the original data X is normalized using the maximum and minimum normalization, and the formula is:

[0089]

[0090] After data normalization, the speed of gradient descent to find the optimal solution can be accelerated, and the accuracy of anomaly detection and diagnosis can be improved.

[0091] Figure 3 A schematic diagram of the sliding window involved in the multivariate time series data anomaly event diagnosis method provided in the present application is shown in FIG. 2. As shown in FIG. 2, the normalized data is divided using a sliding window method; using a sliding window with a window size of w and a step size of 1, T-w+1 time series can be obtained. The time series at time t is represented as: Figure 3 X t = {x t-w ,x t-w+1 ,…,x t-1} E R w×m

[0092]

[0093] where X t is the time series at time t, w is the window size, and m is the indicator.​​

[0094] S2, obtaining time encoding, numerical encoding and position encoding according to the multivariate time series of each moment, and fusing the time encoding, numerical encoding and position encoding to obtain a feature encoding sequence;

[0095] In some embodiments, the S2 comprises:

[0096] S21, extracting time features and space features in the multivariate time series of each moment to obtain time encoding values and position encoding values;

[0097] S22, obtaining numerical encoding corresponding to each moment by convolving the multivariate time series of each moment;

[0098] S23, expanding the time encoding values and the position encoding values to obtain time encoding and position encoding with the same dimension as the numerical encoding;

[0099] S24, adding the numerical encoding, the time encoding and the position encoding to obtain a feature encoding sequence.

[0100] In order to capture the time correlation of data, the method of time embedding is used to extract the time feature information such as seconds, minutes and hours in the time stamp column of the preprocessed data to obtain time encoding.

[0101] Figure 4 The schematic diagram of encoding embedding involved in the multivariate time sequence data abnormal event diagnosis method provided by the present application is shown in Figure 4 In some embodiments, the time encoding includes hour encoding, minute encoding and second encoding, and the specific calculation formula of the time encoding value is:

[0102]

[0103]

[0104]

[0105] wherein h t is the hour encoding value, m t is the minute encoding value, s t is the second encoding value, TimeStamp t table is the time stamp data at t moment, respectively, the hour information, minute information and second information in the time stamp data;

[0106] The calculation formula of the numerical encoding is:

[0107] Vt = Conv(X t )

[0108] wherein V t is a numerical encoding, X t is a multivariate time series at time t of convolution;

[0109] It should be noted that in the embodiments of the present application, the dimension of the numerical encoding V t is R w×d , and d is the dimension of the output feature obtained by convolution operation.

[0110] The calculation formula of the position encoding value is:

[0111]

[0112] wherein p t is a position encoding value, pos t is the absolute position of the numerical encoding V t in the entire time series window.

[0113] It should be noted that the numerical encoding V t is obtained by convoluting the multivariate time series X t at time t, and the position encoding P t is a spatial feature encoding extracted from the data sequence.

[0114] It should be further noted that the position encoding is obtained by using sine or cosine transformation according to whether pos t is an even position or an odd position in the time series window; the values of the hour encoding, the minute encoding, and the second encoding in the time encoding are obtained by extracting the hour information minute information second information in the timestamp TimeStamp t at each time point and mapping them to [-0.5, 0.5].

[0115] By copying and extending all the encoding values in the window w into d dimensions, the position encoding P t and the time encoding H t , M t , S t can be obtained, and P t , H t , M t , S t ∈ R w×d . The numerical encoding, the position encoding, and the time encoding are added to obtain the input Z t of the subsequent Informer prediction model, i.e., the feature encoding sequence.

[0116] In some embodiments, the calculation formula of the feature encoding sequence is:

[0117] Z t =V t +P t +H t +M t +S t

[0118] wherein Z t is a feature encoding sequence, V t is a numerical encoding, P t is a position encoding, H t is an hour encoding, M t is a minute encoding, and S t is a second encoding.

[0119] S3, inputting the feature encoding sequence into an Informer prediction model, and obtaining a prediction value at each time point through the Informer prediction model;

[0120] Specifically, in the embodiments of the present application, the prediction model based on Informer is used to perform prediction analysis on the input time sequence Zt, and the purpose is to obtain the prediction value at time t Informer is a time series prediction model improved based on Transformer, which has three unique features:

[0121] (1) ProbSparse self-attention mechanism, which achieves O(LlogL) in terms of time complexity and memory usage, and has comparable performance in alignment of sequence dependency;

[0122] (2) Self-attention distillation, which highlights the dominant attention by halving the input of cascading layers, and effectively handles extremely long input sequences;

[0123] (3) Generative decoder, which predicts long time series in one forward operation instead of step-by-step prediction, which greatly improves the inference speed of long sequence prediction.

[0124] Figure 5 The schematic diagram of the Informer prediction model involved in the multi-element time series data abnormal event diagnosis method provided in the present application is shown in FIG. 1, wherein the data after time embedding encoding is input into the encoder of the Informer model, and the output of the encoding and decoding structure is the prediction value at time t. Figure 5

[0125] wherein the encoder input Z en = Z t = {z t-w , z t-w+1 , …, z​t-1}, decoder input Z de = {z t-w / 2 , z t-w / 2+1 , …, z t-1 , 0}. Z en The hidden layer state is extracted by the multi-head ProbSparse attention mechanism in the encoder, and the hidden layer state and the decoder input Z de are input into the decoder together, pass through a series of attention layers and fully connected layers, and finally output the prediction value at time t

[0126]

[0127] The loss function of the prediction model adopts the mean square error loss function MSE, which is used to describe the difference between the true value x t and the prediction value at time t, and its formula is as follows:

[0128]

[0129] S4, compare the prediction value with the true value at the corresponding time to obtain the prediction error at each time, and calculate the anomaly score of each time data according to the prediction error;

[0130] Figure 6 The anomaly score calculation involved in the multi-element time series data anomaly event diagnosis method provided in the present application is shown in the schematic diagram as shown in Figure 6 In some embodiments, the S4 includes:

[0131] S41, obtain the prediction error at each time according to the difference between the true value and the prediction value at each time;

[0132] Specifically, compare the true value x t and the prediction value at time t to calculate the prediction error of index i at time t, and the calculation formula of the prediction error is:

[0133]

[0134] Wherein, Err i (t) is the prediction error of index i at time t, x t is the true value at time t, is the prediction value at time t;

[0135] S42, perform mean-variance normalization processing on the prediction error at each time to obtain an anomaly score matrix based on each index at each time;

[0136] S43, obtaining an abnormal score of each index at a single time point according to the abnormal score matrix;

[0137] Since different indexes can have very different characteristics, the scales of their prediction errors can also be very different. In order to prevent any index from producing an error that exceeds other indexes, the mean-variance normalization of the prediction error of each index is performed to obtain an abnormal score.

[0138] Specifically, the calculation formula of the abnormal score is:

[0139]

[0140] Wherein, s i (t) is an abnormal score, μ i is the mean of Err i , and σ i is the variance of Err i .

[0141] The abnormal scores of all indexes at all times constitute an abnormal score matrix S, wherein S(t) represents the abnormal scores of all indexes at time t S(t) = [s1(t),..., s m (t)] T .

[0142] S44, among the abnormal scores of each index at the single time point, the maximum abnormal score is taken as the abnormal score of the time point.

[0143] Specifically, the abnormal score as(t) of the time point is:

[0144]

[0145] S5, comparing the abnormal score with a preset threshold value, and obtaining an abnormal detection result of each time point data according to a comparison result;

[0146] In order to determine whether an abnormality occurs, after obtaining the abnormal score as, a threshold value thr needs to be determined for the judgment of abnormality occurrence. If the abnormal score as exceeds the preset threshold value thr, the time point is marked as abnormal, otherwise it is regarded as normal. In the present application, a grid search method is used to select the threshold value.

[0147] S6, calculating a root cause score vector according to an abnormal event determined according to the abnormal detection result, and diagnosing an abnormal index causing the abnormal event based on the root cause score vector.

[0148] In some embodiments, the S6 comprises:

[0149] S61, determining an abnormal event based on the abnormal detection result;

[0150] Specifically, all abnormal events constitute the abnormal event set E = {e1, e2, ..., e...} n}, where n is the number of abnormal events; Figure 7 A schematic diagram illustrating the anomaly diagnosis involved in the multivariate time-series data anomaly event diagnosis method provided in this application is shown below. Figure 7 As shown, in this application, a continuous series of abnormal time points is defined as an abnormal event, and abnormal event e j All have abnormal start time s j and end time d j .

[0151] S62. Based on the abnormal events, obtain the corresponding abnormal score matrix;

[0152] Specifically, based on the start and end times of the anomaly, the anomaly score matrix corresponding to the anomaly event can be represented as follows: Among them l j It is the duration of the abnormal event.

[0153] S63. In the time dimension, the abnormal score matrix is ​​summed to obtain the root cause score vector, which includes the root cause score corresponding to each indicator.

[0154] Specifically, the root cause score vector is:

[0155]

[0156] S64. Sort the results according to the root factor scores to obtain the sorting results;

[0157] S65. Based on the ranking results, the indicators corresponding to the selected root cause scores are diagnosed as abnormal indicators.

[0158] Specifically, the indicators are sorted from largest to smallest based on the root cause scores, resulting in the sorted root cause score vector Rank(R(e)) = [k1, k2, ..., k m ]∈R m , where k represents the indicator. The top-ranked indicators in Rank(R(e)) are the diagnosed abnormal indicators.

[0159] More specifically, in the embodiments of this application, the number of abnormal indicators diagnosed is 1 times the true root cause or 1.5 times the true root cause, and the number of indicators is related to the indicators HitRate@100 and HitRate@150 of the abnormal diagnosis performance.

[0160] The application determines an abnormal event through multiple steps of preprocessing, encoding embedding, time series prediction, abnormal score calculation, abnormal detection and abnormal diagnosis of multivariate time series data. The original data is normalized by data preprocessing, and is divided into multivariate time series by a sliding window method. The time characteristics of the preprocessed data are extracted in the encoding embedding part, and the extracted time characteristics and the original data are fused to obtain new data. In the time series prediction part, the data is input into the Informer prediction model, and the output is the predicted value at the corresponding time. In the abnormal score calculation part, the predicted value and the true value are compared to obtain the prediction error, and then the abnormal score of each time point data is calculated. In the threshold selection part, the preset threshold is compared with the abnormal score to obtain the abnormal detection result of each time point data. The time characteristics of the time series data are extracted through time encoding embedding, the accuracy of abnormal diagnosis is improved under the premise of ensuring the accuracy and efficiency of abnormal detection, the continuous abnormal time points detected are determined as abnormal events, the root cause score of the index is calculated for diagnosis and analysis of the abnormal events, the abnormal index is determined according to the root cause score, and the detection efficiency and diagnosis accuracy of the multivariate time series are improved.

[0161] The application also provides a multivariate time series data abnormal event diagnosis device, which comprises:

[0162] A preprocessing module is configured to preprocess original data in multivariate time series to obtain multivariate time series at each time point.

[0163] A fusion module is configured to extract time characteristics of the multivariate time series at each time point, obtain time encoding, numerical encoding and position encoding according to the time characteristics, and fuse the time encoding, numerical encoding and position encoding to obtain a feature encoding sequence.

[0164] A time series prediction module is configured to input the feature encoding sequence into an Informer prediction model to obtain a predicted value at each time point through the Informer prediction model.

[0165] An abnormal score calculation module is configured to compare the predicted value with a true value at the corresponding time to obtain a prediction error at each time point, and calculate an abnormal score of data at each time point according to the prediction error.

[0166] An abnormal detection module is configured to compare the abnormal score with a preset threshold to obtain an abnormal detection result of data at each time point according to the comparison result.

[0167] An abnormal diagnosis module is configured to calculate a root cause score vector according to an abnormal event determined by the abnormal detection result, and diagnose an abnormal index causing the abnormal event based on the root cause score vector.

[0168] The application also provides a terminal device, comprising:

[0169] a memory for storing a computer program;

[0170] a processor for reading the computer program in the memory and performing the corresponding operations of the multi-element time series data abnormal event diagnosis method.

[0171] The application also provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the multi-element time series data abnormal event diagnosis method.

[0172] The following is a specific embodiment:

[0173] The method of the application is evaluated on two time series data sets, as follows:

[0174] SWaT: The secure water treatment data set comes from a water treatment test bench coordinated by the Public Utilities Board of Singapore, and the collection process lasts for 11 days, the system runs 24 hours a day, and all 51 sensors and actuators obtain network traffic and numerical values.

[0175] WADI: The water distribution data set is a distribution system consisting of a large number of water distribution pipelines, and WADI forms a more complete and realistic water treatment, storage and distribution network as an extension of the SWAT test bench. The data set includes a total of 16 days of continuous operation, of which 14 days are regular operation and 2 days are attack scenarios. The entire test bench contains 127 sensors and drivers. Table 1 is a summary of the data set, as follows:

[0176] Table 1 Summary of the data set

[0177] Dataset Timing number Training set Test set Abnormal rate SWaT 51 49500 45000 11.97％ WADI 127 76297 17280 5.99％

[0178] In order to verify the rationality and advancement of the method proposed in the application, comparative experiments are performed between the abnormality detection method and TCN-AE, OmniAnomaly, MSCRED, GTA, and Informer.

[0179] TCN AE: The temporal convolutional autoencoder (Temporal convolutional autoencoder) uses an automatic encoder based on extended convolution, and detects abnormalities by using the error between the input and the reconstructed output.

[0180] OmniAnomaly: The Gated Recurrent Unit (GRU) is used to capture the complex time correlation between multivariate observations, and the VAE is used to map the observations to random variables.

[0181] MSCRED: Multi-Scale Convolutional Recurrent Encoder-Decoder utilizes a convolutional encoder to encode the correlation characteristics between variables, and a convolutional long short-term memory (ConvLSTM) to capture time-dependent characteristics. Finally, a decoder is used to reconstruct the features to detect and diagnose anomalies.

[0182] Informer: Informer uses an encoder-decoder structure that integrates an attention mechanism to capture the time characteristics of multivariate time series and predict the numerical values at a time point. On this basis, anomaly detection and diagnosis functions are added, and the method is consistent with the present application. The difference from the present application is that it lacks a time embedding module.

[0183] GTA: GTA adds an anomaly detection part to the Informer prediction model, but lacks an anomaly diagnosis function. The same anomaly diagnosis part as the present application is added to it, and the anomaly detection part is consistent with the present application. The difference from the present application is that it uses a graph convolution module instead of a time embedding module for feature extraction.

[0184] The model hyperparameters used in the present application are the same as those of Informer and GTA. The number of layers of the encoder is set to 3, and the number of layers of the decoder is set to 2. For the traditional multi-head attention mechanism, the number of heads is set to 8. The dimension of the fully connected network is set to 128, which is equal to the dimension of the model.

[0185] The present application conducts 3 experiments for each experiment and calculates the average value.

[0186] The precision (Prec), recall (Rec) and F1-score (F1) are used to evaluate the method of the present application for anomaly detection, and their formulas are as follows:

[0187]

[0188]

[0189]

[0190] Among them, TP represents the true detected anomaly, FP represents the false detected anomaly, TN represents the correctly identified normal sample, and FN represents the false identified normal sample.

[0191] The anomaly diagnosis uses HitRate@100, HitRate@150, RC-top-3 to evaluate the anomaly diagnosis performance of the model. HitRate@100 and HitRate@150 are the hit rates of the root causes diagnosed by the anomaly event on the true root causes. If the number of true root causes of a certain anomaly event is r, the number of hits of the top r root causes in the root cause list obtained by the model in diagnosing the anomaly event with the true root causes is h 100 , the number of hit root causes in the top 1.5r is h 150 . Then HitRate@100 = h 100 / r, HitRate@150 = h 150 / r. RC-top-3 represents the probability that the first three root causes diagnosed by the anomaly event contain the true root cause, and if the first three contain the true root cause, the value is 1. All evaluation indicators are the average values obtained under all anomaly events.

[0192] Table 2 Comparison of best F1 score performance of different methods on SWaT and WADI datasets

[0193]

[0194] The best F1 score obtained by different methods on SWaT and WADI datasets is shown in Table 2. It can be seen from the table that the Transformer-based models GTA, Informer and the method of the present application have a great advantage in accuracy compared with other models, and the F1 scores of the three methods are not much different. The precision of the model of the present application is the highest among all models, and the F1 score is improved by about 0.3% compared with the original Informer model.

[0195] In actual industrial production, the speed of model training is as important as the accuracy, and Table 3 compares the training time of Transformer-based models on two datasets.

[0196] Table 3 Comparison of training time of SWaT and WADI in different methods

[0197]

[0198] As can be seen from Table 3, the method of the present application has greatly improved efficiency compared with GTA. The total training time is only half of that of GTA, and the Epoch num represents the number of times all data in a training process enters the model, and the average training time per Epoch is about 60%-80% of that of GTA. The reason for the great efficiency improvement is that the time embedding module is used to extract the time features of the data. Compared with the graph convolution module in GTA, the time embedding module of the present application has lower training overhead. The method of the present application can obtain detection performance similar to that of GTA in less training time.

[0199] Table 4 Comparison of abnormal diagnosis indicators of SWAT and WADI under different methods

[0200]

[0201]

[0202] The present application compares the strengths and weaknesses of different methods in abnormal diagnosis performance on SWaT and WADI datasets, as shown in Table 4. Among them, the tp suffix means only considering the abnormal events detected by the anomaly detection, and the all suffix means considering all abnormal events.

[0203] On the SWAT dataset, GTA, Informer and the method of the present application based on the Transformer model have a great lead in abnormal diagnosis indicators compared with other methods. Among the three methods, GTA performs the worst, and the method of the present application performs the best. The reason is that the graph convolution module added in the GTA model confuses the features between each indicator, which is not conducive to abnormal diagnosis. And the time embedding module added in the model of the present application extracts effective time features without confusing the features of each indicator, enhancing the performance of abnormal diagnosis.

[0204] On the WADI dataset, the OmniAnomaly method is higher than the method of the present application in the evaluation indicators with the tp suffix, but this does not mean that its abnormal diagnosis effect is better. The reason is that the number of abnormal events detected is small, resulting in a small denominator when calculating the evaluation indicators. In fact, the method of the present application detects more abnormal events, and the abnormal diagnosis effect is also better. The reason why the abnormal diagnosis evaluation indicators of the MSCRED method are close to 0 is that in order to process the high-dimensional dataset WADI within an acceptable overhead, PCA (Principal Component Analysis) method is used for dimensionality reduction in the data preprocessing part. This operation changes the dimensionality of the dataset, so it cannot normally perform abnormal diagnosis. In addition, the indicators of other methods are generally not as good as the method of the present application.

[0205] In summary, from each table, it can be seen that the method of the present application has the best comprehensive effect in terms of anomaly detection efficiency and anomaly diagnosis performance.

[0206] It should be understood that, although each step in the flowchart in the above embodiments is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless explicitly stated herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other sequences. Moreover, at least part of the steps in the figure can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0207] It can be understood by those skilled in the art that all or part of the processes in the above embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above embodiments of each method. Any reference to memory, storage, database or other medium used in each embodiment provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0208] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0209] It is to be understood that the application is not limited to the precise construction already described above and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application should only be limited by the claims appended hereto.

Claims

1. A method for diagnosing an abnormal event of multivariate time series data, characterized by, The method comprises the following steps: S1, preprocessing the original data in the multivariate time sequence to obtain a multivariate time sequence at each time point; S2, obtaining time encoding, numerical encoding and position encoding at each time point according to the multivariate time sequence at each time point, and fusing the time encoding, numerical encoding and position encoding to obtain a feature encoding sequence; S3, inputting the feature encoding sequence into an Informer prediction model to obtain a predicted value at each time point through the Informer prediction model; S4, comparing the predicted value with a true value at the corresponding time point to obtain a prediction error at each time point, and calculating an anomaly score of the data at each time point according to the prediction error; S5, comparing the anomaly score with a preset threshold to obtain an anomaly detection result of the data at each time point according to a comparison result; S6, calculating a root cause score vector according to an abnormal event determined according to the anomaly detection result, and diagnosing an abnormal index causing the abnormal event based on the root cause score vector; The S6 comprises: S61, determining an abnormal event based on the anomaly detection result; S62, obtaining a corresponding anomaly score matrix according to the abnormal event; S63, summing the anomaly score matrix in the time dimension to obtain a root cause score vector, wherein the root cause score vector comprises a root cause score corresponding to each index; S64, sorting the root cause scores according to their sizes to obtain a sorting result; S65, diagnosing an index corresponding to a selected root cause score as an abnormal index based on the sorting result.

2. The abnormal event diagnosis method according to claim 1, characterized by, The S2 comprises: S21, extracting time features and space features in the multivariate time sequence at each time point to obtain time encoding values and position encoding values; S22, obtaining a numerical encoding corresponding to each time point by convolving the multivariate time sequence at each time point; S23, expanding the time encoding values and the position encoding values to obtain time encoding and position encoding with the same dimension as the numerical encoding; S24, adding the numerical encoding, the time encoding and the position encoding to obtain a feature encoding sequence.

3. The abnormal event diagnosis method according to claim 2, characterized by, The specific calculation formula of the time encoding value is: ； ； ； wherein, is a value of hours encoding, is a value of minutes encoding, is a value of seconds encoding, is a time stamp data at time t, are hour information, minute information, and second information in the time stamp data, respectively. The formula of the numerical encoding is: ； wherein, is a numerical encoding, is a multivariate time series of convolution t instances; The calculation formula of the position encoding value is: ； wherein, is a position encoding, is a value encoding absolute position in the entire time series window.

4. The abnormal event diagnosis method according to claim 1, characterized by, The preprocessing comprises normalization processing and sliding window division processing.

5. The abnormal event diagnosis method according to claim 1, characterized by, The S4 comprises: S41, obtaining a prediction error at each time point according to a difference between the true value and the predicted value at each time point; S42, performing mean-variance normalization processing on the prediction error at each time point to obtain an anomaly score matrix based on each index at each time point; S43, obtaining an anomaly score of each index at a single time point according to the anomaly score matrix; S44, taking the maximum anomaly score in the anomaly scores of each index at the single time point as the anomaly score of the time point.

6. The abnormal event diagnosis method according to claim 5, characterized by, The calculation formula of the prediction error is: ； wherein, is the prediction error for index i at time t, is the true value at time t, is the predicted value at time t; The calculation formula of the anomaly score is: ； wherein, is the mean of the abnormal scores, is is the mean of the abnormal scores, is is the variance of the abnormal scores.

7. A multi-variate time-series data anomaly event diagnosis apparatus characterized by comprising: The device comprises: a preprocessing module configured to preprocess original data in a multivariate time sequence to obtain a multivariate time sequence at each time point; a fusion module configured to extract time features of the multivariate time series at each time point, obtain time encoding, numerical encoding and position encoding of each time point according to the time features, and fuse the time encoding, numerical encoding and position encoding to obtain a feature encoding sequence; a time series prediction module configured to input the feature encoding sequence into an Informer prediction model to obtain predicted values of each time point through the Informer prediction model; an anomaly score calculation module configured to compare the predicted values with true values of the corresponding time points to obtain prediction errors of each time point, and calculate anomaly scores of data of each time point according to the prediction errors; an anomaly detection module configured to compare the anomaly scores with a preset threshold, and obtain anomaly detection results of data of each time point according to a comparison result; an anomaly diagnosis module configured to calculate a root cause score vector according to an abnormal event determined based on the anomaly detection results, and diagnose abnormal indicators causing the abnormal event based on the root cause score vector, specifically including: determining an abnormal event based on the anomaly detection results, obtaining a corresponding anomaly score matrix according to the abnormal event, summing the anomaly score matrix in a time dimension to obtain a root cause score vector, wherein the root cause score vector includes root cause scores of each indicator, sorting the root cause scores according to their sizes to obtain a sorting result, and diagnosing an indicator corresponding to a selected root cause score as an abnormal indicator based on the sorting result.

8. A terminal device, comprising: comprise: a memory configured to store a computer program; a processor configured to read the computer program in the memory and perform operations corresponding to the multivariate time series data anomaly event diagnosis method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the multivariate time series data anomaly event diagnosis method according to any one of claims 1-6.

Images