Online anomaly detection method and system for spatiotemporal data based on concept drift adaptation

Abstract

The present invention provides a method and system for online anomaly detection of spatiotemporal data based on concept drift adaptation, the method comprising: using historical spatiotemporal data to perform offline training on an LSTM autoencoder to obtain an initial anomaly detection model; for the spatiotemporal data received in real time, determining whether concept drift exists, and if so, updating the anomaly detection model; performing anomaly detection on the spatiotemporal data using the updated anomaly detection model to determine whether the current spatiotemporal data is abnormal; and outputting anomaly detection results. The present invention targets the concept drift phenomenon existing in spatiotemporal data, and adjusts the anomaly detection model through a concept drift adaptive algorithm to update it to adapt to the new data distribution. Different from the previous spatiotemporal data anomaly detection algorithm, the present invention can detect anomalies in spatiotemporal data in real time online.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an online anomaly detection method and system for spatiotemporal data based on concept drift adaptation. Background Art

[0002] With the popularization of mobile computing and sensor technology, the speed of spatiotemporal data generation is getting faster and faster, and the amount of data is getting larger and larger. The distribution of data may change over time, resulting in concept drift, so the difficulty and complexity of data analysis will increase accordingly. In such an environment, how to find mobile objects that seriously deviate from normal patterns in spatiotemporal data in a timely manner and discover potentially dangerous behavior patterns hidden in massive data is becoming increasingly important.

[0003] Concept drift detection methods are generally divided into two categories: distribution-based methods and performance-based methods. Distribution-based methods identify concept drift by detecting changes in data distribution, such as changes in mean and variance, and usually require the use of predefined historical time periods and new time periods, which requires higher computational costs. Performance-based methods identify concept drift based on changes in metrics used to evaluate model performance, such as decreased accuracy and increased error rate. If the data distribution is stable and there is no drift, the error rate of the model should gradually decrease or remain unchanged as the number of learned data samples increases. In contrast, if the error rate rises sharply as the amount of processed data increases, this usually indicates the occurrence of concept drift. However, performance-based algorithms generally require a large amount of labeled data, which is difficult for real-world data.

[0004] Existing methods for detecting anomalies in spatiotemporal data are mainly divided into statistical methods, distance methods, density methods, clustering methods, classification methods, and neural network methods. Statistical methods use mathematical models to perform statistical analysis on data to identify abnormal data that deviates significantly from normal data. However, statistical methods rely on clear positioning of anomalies, but in some cases, it may be difficult to clearly define "abnormality". Density-based methods use the uneven distribution characteristics of data point density to regard data far away from most data points as abnormal. However, this method is sensitive to parameter selection and may misjudge data sets with uneven density. Clustering-based methods regard data far away from the center of the cluster to which it belongs as abnormal, but for dense data sets, it is impossible to accurately divide abnormal and normal data. Classification-based methods use existing normal and abnormal samples to train classifiers, and then predict new data to determine whether it is abnormal. However, the performance of the algorithm depends largely on the quantity and quality of training data. In practical applications, it is often very difficult to obtain a large amount of accurately labeled data. Neural network-based methods learn normal behavior models through neural network training and then perform anomaly detection. However, the algorithm is only for historical spatiotemporal data. Once the model is established, it is not easy to update and is not suitable for data with high real-time requirements.

[0005] The above methods each have different advantages and applicable fields, but they are only suitable for batch processing of data, and have great limitations for data that is generated quickly, in large quantities, and has concept drift. In practical applications, people are usually more concerned about whether the data collected in real time is abnormal, so they pay more attention to the current situation rather than the historical status, so the above methods can no longer meet the requirements of processing speed, versatility, etc. In addition, when normal behavior changes, the offline anomaly detection model may not be able to adapt to the new changes, so when new data arrives, it is necessary to learn and update the model in an online learning manner in a dynamically changing and non-stationary environment. Therefore, the anomaly detection model must be able to start identifying anomalies as soon as possible with a small amount of initial knowledge, and dynamically adjust the internal information of the model as new data arrives. Summary of the invention

[0006] In view of the above problems, the purpose of the present invention is to provide a method and system for online anomaly detection of spatiotemporal data based on concept drift adaptation, which uses historical spatiotemporal data to perform offline training on the LSTM autoencoder to obtain an initial anomaly detection model, and then adjusts the model through a concept drift adaptive algorithm to update it to adapt to the new data distribution, thereby determining the anomalies in the spatiotemporal data in real time.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] On the one hand, a method for online anomaly detection of spatiotemporal data based on concept drift adaptation is provided, the method comprising the following steps:

[0009] S1. Use historical spatiotemporal data to train the LSTM autoencoder offline to obtain the initial anomaly detection model.

[0010] S2. For the spatiotemporal data received in real time, determine whether there is a concept drift, and if there is a concept drift, update the anomaly detection model;

[0011] S3, using the updated anomaly detection model to perform anomaly detection on the spatiotemporal data to determine whether the current spatiotemporal data is abnormal;

[0012] S4. Output anomaly detection results.

[0013] Optionally, the step S1 specifically includes:

[0014] Perform normalization preprocessing on historical spatiotemporal data; perform feature extraction on the historical spatiotemporal data after normalization preprocessing; convert the historical spatiotemporal data after feature extraction into a window sequence of preset length, and input it into the LSTM autoencoder for offline training.

[0015] Optionally, the feature extraction of the normalized pre-processed historical spatiotemporal data specifically includes:

[0016] For historical spatiotemporal data after normalization preprocessing:

[0017] The basic features are obtained by using the mean and variance, the spatial semantic features are obtained by using the correlation vector and the difference vector, and the context features are obtained by using the gradient vector; the basic features, the spatial semantic features, and the context features constitute the temporal features;

[0018] One-hot encoding is used to obtain spatial geographic location features.

[0019] Optionally, the historical spatiotemporal data after feature extraction is converted into a window sequence of a preset length and input into an LSTM autoencoder for offline training, specifically including:

[0020] The historical spatiotemporal data after feature extraction is converted into a window sequence of length w, input into the LSTM autoencoder, and encoded, decoded, and reconstructed through the LSTM autoencoder to obtain a reconstructed sequence;

[0021] According to the reconstruction error between the reconstructed sequence and the input window sequence, the LSTM autoencoder is trained to obtain the initial anomaly detection model.

[0022] Optionally, the step S2 specifically includes:

[0023] Setting a test window and an adaptive window; the test window is used to detect whether there is concept drift in the spatiotemporal data received in real time, and the adaptive window is used to store sample data for updating the anomaly detection model;

[0024] For the spatiotemporal data received in real time, if the accuracy of the data in the inspection window drops to the warning threshold α, it means that the warning state is reached, and the adaptive window starts to collect the incoming data as sample data that may have concept drift;

[0025] Afterwards, if the accuracy of the data in the test window continues to drop to the drift threshold β, it indicates that concept drift has occurred, and the anomaly detection model is updated using the sample data with new distribution collected in the adaptive window;

[0026] If the accuracy of the data in the test window stops decreasing or rises to a normal level in the warning state, it is regarded as a false warning; at this time, the sample data in the adaptive window is released and monitoring of new concept drifts is restarted.

[0027] Optionally, when one of the following two conditions is met, the adaptive window starts to collect sample data with a new distribution:

[0028] 1) The accuracy of the data in the inspection window drops to a first threshold α;

[0029] 2) The adaptive window length reaches the preset maximum value L max ;

[0030] For α, β, L max The three parameters are optimized using particle swarm algorithm to obtain the optimal parameter combination for building the online anomaly detection model.

[0031] Optionally, the step S3 specifically includes:

[0032] Use the updated anomaly detection model to perform anomaly detection on spatiotemporal data and obtain anomaly scores;

[0033] For the obtained abnormal scores, the tail of the probability distribution is fitted based on the extreme value theory, and a dynamic threshold is set for judgment, as follows:

[0034] If the anomaly score of the spatiotemporal data at time t is greater than or equal to the dynamic threshold th at time t t , it is marked as abnormal data; if the abnormal score of the spatiotemporal data at time t is less than the dynamic threshold th at time t t , it is marked as normal data.

[0035] On the other hand, an online anomaly detection system for spatiotemporal data based on concept drift adaptation is provided, comprising:

[0036] The offline training module is used to perform offline training on the LSTM autoencoder using historical spatiotemporal data to obtain an initial anomaly detection model;

[0037] An updating module, for determining whether there is a concept drift for the spatiotemporal data received in real time, and updating the anomaly detection model if there is a concept drift;

[0038] The detection module is used to perform anomaly detection on spatiotemporal data using an updated anomaly detection model to determine whether the current spatiotemporal data is abnormal;

[0039] The output module is used to output anomaly detection results.

[0040] In another aspect, an electronic device is provided, the electronic device comprising:

[0041] processor;

[0042] A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are loaded and executed by the processor, the steps of the above-mentioned method for online anomaly detection of spatiotemporal data are implemented.

[0043] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the computer-readable storage medium, and the at least one instruction is loaded and executed by a processor to implement the steps of the above-mentioned online anomaly detection method for spatiotemporal data.

[0044] The beneficial effects brought about by the technical solution provided by the present invention include at least:

[0045] Aiming at the anomaly problem in spatiotemporal data, the present invention proposes an online anomaly detection method for spatiotemporal data based on concept drift adaptation, uses LSTM autoencoder for offline training to obtain the initial anomaly detection model, and adjusts the anomaly detection model through the concept drift adaptive algorithm to update it to adapt to the new data distribution in view of the unstable concept drift phenomenon in spatiotemporal data, and determines the anomaly in the data in real time. Different from the previous anomaly detection algorithm for spatiotemporal data, the present invention can detect anomalies in spatiotemporal data in real time online. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1It is a flow chart of a method for online anomaly detection of spatiotemporal data based on concept drift adaptation provided by an embodiment of the present invention;

[0048] Figure 2 It is a specific flow chart of a method for online anomaly detection of spatiotemporal data based on concept drift adaptation provided by an embodiment of the present invention;

[0049] Figure 3 It is a schematic diagram of some detection results of the online anomaly detection method provided by an embodiment of the present invention;

[0050] Figure 4 is a schematic diagram of the running time results of different methods provided by the embodiments of the present invention;

[0051] Figure 5 It is a structural diagram of an online anomaly detection system for spatiotemporal data based on concept drift adaptation provided by an embodiment of the present invention;

[0052] Figure 6 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Considering that the distribution of spatiotemporal data will produce concept drift as time and actual conditions change, although the existing spatiotemporal data anomaly detection methods have certain detection performance, they are only for historical spatiotemporal data, the model training time is long, and once established, it is not easy to update, which is not suitable for occasions with high real-time requirements.

[0055] Therefore, an embodiment of the present invention provides an online anomaly detection method for spatiotemporal data based on concept drift adaptation (Online Anomaly Detection Algorithm with Adaptive Concept Drift, OAD-ACD).

[0056] The object of the present invention is to obtain a given spatiotemporal data sequence X = (x1, x2, ..., x t ,…,x T ), is the m-dimensional data obtained at time t, where lont ,lat t Indicates the spatial location of the data. Represents the temporal characteristics of the data. Based on the anomaly detection model trained offline, the model is learned and updated in a dynamically changing and non-stationary environment through online learning, so that the model can capture the trends and potential patterns of spatiotemporal data, thereby obtaining the anomaly label sequence Y = (y1, y2, ..., y t ,…,y T ), y t ∈{0,1}, where y t =0 means that the data at time t is normal, y t =1 indicates that the data at time t is abnormal, providing early warning information for decision makers to avoid or reduce losses caused by abnormal data.

[0057] like Figure 1 As shown, the online anomaly detection method for spatiotemporal data based on concept drift adaptation of the present invention comprises the following steps:

[0058] S1. Use historical spatiotemporal data to perform offline training on the LSTM autoencoder to obtain the initial anomaly detection model.

[0059] Spatiotemporal data is usually collected by sensors. The data collected by sensors changes with time and location, forming a spatiotemporal data sequence with time series characteristics and spatial geographic location characteristics. Due to the continuity and dynamics of spatiotemporal data, online anomaly detection usually requires a lot of time and computing resources, while offline modeling can use historical data and prior knowledge to conduct in-depth analysis and mining of the inherent laws and patterns of spatiotemporal data, providing a more accurate and reliable model for subsequent online anomaly detection. Therefore, in the offline model training stage, historical spatiotemporal data is used to train the anomaly detection model to capture the distribution and potential patterns of the data.

[0060] Specifically, this step includes:

[0061] (1) Normalize and preprocess historical spatiotemporal data.

[0062] Data normalization can eliminate scale differences and discrete degree differences between data, making it easier to discover the true correlation in the data.

[0063] Therefore, for a given historical spatiotemporal data X = (x1, x2, ..., x t ,…,x T ),according to Normalization preprocessing is performed, where is the normalized data, min(X) and max(X) are the minimum and maximum vectors in the historical spatiotemporal data X, and ε is a very small constant vector set to avoid the denominator being 0.

[0064] (2) Feature extraction of historical spatiotemporal data after normalization preprocessing.

[0065] In view of the fact that the original data may contain a large amount of redundant, noisy or irrelevant information, the present invention removes redundant information through feature extraction, simplifies the data processing process, and reveals the patterns and laws hidden in the data that are not easy to directly observe.

[0066] The present invention extracts the temporal characteristics of data from three aspects: basic characteristics of data, spatial semantic characteristics, and contextual characteristics. Use mean and variance To obtain its basic characteristics; in order to capture data Relative to the spatial semantic change features of its neighboring points, the relevant vector and the difference vector To obtain its spatial semantic features, Represents data points The m-th dimension feature and its adjacent points The Pearson correlation coefficient of the m-th dimension feature, Represents data points The m-th dimension feature and its adjacent points The direct difference of the m-th dimension feature; using the gradient vector Grad t =(r t,t-1 ,r t+1,t ) to capture The spatial correlation changes of r are used to obtain context features, where r t,t-1 =Corr t -Corr t-1 , r t+1,t =Corr t+1 -Corr t .

[0067] The spatial geographic location of data is an important attribute of spatiotemporal data. Many abnormal situations are related to spatial location, and the spatial distribution and evolution patterns of these abnormal situations may be different over time. Therefore, considering the influence of spatial geographic location in anomaly detection helps to better understand the distribution and change patterns of abnormal phenomena. However, the spatial geographic location factor is a categorical value and cannot be directly input into the neural network. Therefore, the present invention uses One-hot encoding to convert the categorical attributes of spatial geographic location into low-dimensional real vectors to obtain spatial geographic location feature information.

[0068] One-hot encoding means encoding N states with N bits of 0 or 1, each state has an independent representation, and only one bit is 1, and the other bits are 0. Then, an embedding method is used to transform the representation of each category in a low-dimensional space, so that the classification values ​​with similar semantics are embedded in close positions. This can not only effectively reduce the input dimension and make the calculation more efficient, but also help find similar patterns in different information.

[0069] (3) The historical spatiotemporal data after feature extraction is converted into a window sequence of preset length and input into the LSTM autoencoder for offline training.

[0070] In this step, the historical spatiotemporal data after feature extraction is converted into a window sequence of length w, input into the LSTM autoencoder, and encoded, decoded, and reconstructed by the LSTM autoencoder to obtain a reconstructed sequence; according to the reconstruction error between the reconstructed sequence and the input window sequence, the LSTM autoencoder is trained to obtain the initial anomaly detection model.

[0071] Specifically, after feature extraction is completed, the historical spatiotemporal data sequence is converted into a window sequence S = (s w ,s w+1 ,…,s i ,…,s n ), where s i =(x i ,x i+1 ,…,x i+w ), as the input of the LSTM autoencoder.

[0072] The formula of the entire LSTM autoencoder part is as follows:

[0073] f t =σ(W f ·[h t-1 ,s t ]+b f )

[0074] i t =σ(W i ·[h t-1 ,s t ]+b i )

[0075]

[0076]

[0077] o t =σ(W o ·[h t-1 ,s t ]+bo )

[0078] Where σ(·) is the sigmoid function, W f is the forget gate weight, b f is the bias vector, i t For information that needs to be remembered, is a candidate memory unit, used to update the memory unit, tanh is the tanh function, W i and W c is the input gate weight, b i and b c is the bias vector, o t is the calculation vector in the output gate, W o is the output gate weight, b o is the bias vector.

[0079] Then the output of the data after being encoded by the encoder is:

[0080] z t =H(h t )

[0081] Here, H(·) represents the function that obtains information from the hidden layer of the encoder and generates the context vector as the decoder.

[0082] The decoder is the encoded output z t Reconstructed, the output of the decoder is u t , then the reconstruction error of the LSTM autoencoder is Loss t =||u t -s t ||2, the reconstruction error is the anomaly score of the historical spatiotemporal data at time t.

[0083] In the prior art, most researchers directly compare the anomaly score with the set anomaly threshold, and data greater than the anomaly threshold is considered abnormal data. However, due to the existence of concept drift, the patterns of normal data and abnormal data will change over time. Therefore, in a constantly changing environment, the performance of the anomaly detection model may gradually decline. Therefore, when the present invention uses the offline trained anomaly detection model for online anomaly detection, it can timely update the model by judging whether concept drift occurs, thereby maintaining the ability to accurately detect continuously arriving data.

[0084] S2. For the spatiotemporal data received in real time, determine whether there is a concept drift, and if there is a concept drift, update the anomaly detection model.

[0085] In order to detect and adapt to different concept drift situations, the present invention combines the distribution-based and performance-based ideas, sets two types of sliding windows for detecting concept drift phenomena and storing sample data for updating the model, and measures the performance of the anomaly detection model according to the warning threshold and drift threshold in the performance-based algorithm.

[0086] Specifically, for the spatiotemporal data received in real time, if the accuracy of the data in the inspection window drops to the warning threshold α, it means that the warning state is reached, and the adaptive window starts to collect the incoming data as sample data that may have concept drift;

[0087] Afterwards, if the accuracy of the data in the test window continues to drop to the drift threshold β, it indicates that concept drift has occurred, and the anomaly detection model is updated using the sample data with new distribution collected in the adaptive window;

[0088] If the accuracy of the data in the test window stops decreasing or rises to a normal level in the warning state, it is regarded as a false warning; at this time, the sample data in the adaptive window is released and monitoring of new concept drifts is restarted.

[0089] In order to obtain a highly robust model, the sample data collected by the adaptive window with a new distribution should meet one of the following two conditions:

[0090] 1) Compared with before the concept drift, the accuracy of the data in the test window drops to the first threshold α, indicating that the current model may not be able to handle data with new distribution conditions and the model needs to be updated;

[0091] 2) The adaptive window length reaches the preset maximum value L max , thereby ensuring the real-time and memory requirements of anomaly detection.

[0092] Since α, β, L in the algorithm max The three parameters will directly affect the performance of the model. max The present invention adopts particle swarm algorithm to optimize the three parameters to obtain the best parameter combination with the highest accuracy, which is used to build the optimal online anomaly detection model.

[0093] S3. Use the updated anomaly detection model to perform anomaly detection on the spatiotemporal data to determine whether the current spatiotemporal data is abnormal.

[0094] In this step, the updated anomaly detection model is used to detect anomalies in spatiotemporal data to obtain anomaly scores. For the obtained anomaly scores, the tail of the probability distribution is fitted based on the extreme value theory, and a dynamic threshold is set for judgment, as follows:

[0095] If the anomaly score of the spatiotemporal data at time t is greater than or equal to the dynamic threshold th at time t t , it is marked as abnormal data, that is, y t =1; if the anomaly score of the spatiotemporal data at time t is less than the dynamic threshold th at time t t , it is marked as normal data, that is, y t =0.

[0096] S4. Output anomaly detection results.

[0097] Based on the above content, the present invention proposes an online anomaly detection method for spatiotemporal data based on concept drift adaptation. The LSTM autoencoder is used for offline modeling to obtain an initial anomaly detection model. In view of the unstable concept drift phenomenon in the data, the model is adjusted and updated through the concept drift adaptive algorithm to adapt to the new data distribution, and the anomalies in the data are determined in real time.

[0098] Different from the previous spatiotemporal data anomaly detection algorithm, the present invention can detect anomalies in spatiotemporal data in real time online. The specific process of the method is as follows: Figure 2 As shown:

[0099] Input: spatiotemporal data sequence X = (x1, x2, ..., x t ,…,x T );

[0100] Output: abnormal label sequence Y = (y1, y2, ..., y t ,…,y T );

[0101] Step 1: Use historical spatiotemporal data sequences to offline train an anomaly detection model based on LSTM autoencoder.

[0102] Step 2: Determine whether there is concept drift in the real-time spatiotemporal data. If there is concept drift, the anomaly detection model is trained and updated.

[0103] Step 3: According to the anomaly score obtained by the anomaly detection model, determine whether the current spatiotemporal data is abnormal based on the dynamic threshold.

[0104] Step 4: Output the anomaly detection results, that is, the anomaly label sequence Y = (y1, y2, ..., y t ,…,y T ).

[0105] The present invention constructs an anomaly detection model according to historical out-of-control data through Step 1, and detects the real-time spatiotemporal data through Step 2-Step 4. If the distribution of the data changes, that is, there is a concept drift in the data, the offline anomaly detection model is trained and updated to achieve concept drift adaptation, and the abnormal result is determined based on the dynamic threshold according to the obtained abnormal score, and the final abnormal label sequence Y=(y1, y2, ..., y t ,…,y T ).

[0106] In order to more clearly demonstrate the accuracy and effectiveness of the online anomaly detection method for spatiotemporal data based on concept drift adaptation (hereinafter referred to as the OAD-ACD method) described in the present invention, the OAD-ACD method is verified and evaluated from an experimental perspective.

[0107] The embodiment of the present invention selects a car driving data set as a source of spatiotemporal data, describes an offline modeling process, and performs online anomaly detection. The car driving data set includes data generated by multiple dimensions such as sampling time, longitude, latitude, speed, acceleration, and heading change angle. The present invention selects both normal and abnormal data for experiments.

[0108] The experimental environment is: Intel(R) Core(TM), i5-1135G7CPU@2.40GHz processor, 16GB memory, Win1064bit operating system, and Python programming language.

[0109] The present invention uses precision (P), recall (R), F1 score (F1), AUC (Area Under Curve) and other indicators with upper limits of 1 to evaluate the performance of the proposed method. The larger the values ​​of these indicators, the higher the accuracy of the method. In addition, the running time is used to measure the efficiency of the online anomaly detection method. The shorter the running time, the higher the efficiency of the method.

[0110] Precision P, recall R, and F1 score F1 are defined as follows:

[0111]

[0112]

[0113]

[0114] Among them: TP is the number of abnormal data in the data set that are detected as abnormal; FP is the number of normal data in the data set that are detected as abnormal; FN is the number of abnormal data in the data set that are detected as normal.

[0115] AUC is defined as the area under the ROC curve and the coordinate axis. Since the ROC curve is generally above the straight line y=x, the AUC value range is between 0.5 and 1. The closer the AUC value is to 1, the more realistic the algorithm's detection results are.

[0116] The running time is set as the time it takes for the method to batch process 1000 data points. The shorter the running time, the more efficient the method is.

[0117] The main purpose of the OAD-ACD method for online anomaly detection is to obtain an offline anomaly detection model based on historical spatiotemporal data training. Then, when real-time spatiotemporal data arrives, it is determined whether there is a concept drift phenomenon in the real-time spatiotemporal data, whether the model needs to be updated, and perform anomaly detection.

[0118] Before the OAD-ACD method performs online anomaly detection, it is necessary to perform offline modeling based on historical spatiotemporal data to obtain an anomaly detection model. First, by extracting the temporal features and spatial geographic location features of historical spatiotemporal data, the potential dependencies between the data are obtained, and then an offline anomaly detection model based on the LSTM autoencoder is constructed. The offline anomaly detection results are shown in Table 1. It can be seen from Table 1 that the offline anomaly detection model trained with historical spatiotemporal data has the ability to distinguish between normal and abnormal data, and can be used for subsequent online anomaly detection.

[0119] Table 1 Detection results of offline anomaly detection model

[0120]

[0121] After completing offline modeling, online anomaly detection is performed on the real-time spatiotemporal data. In order to verify the effectiveness of the algorithm, it is compared with five anomaly detection algorithms: REBM, ARCUS, Online RNN-AD, MemStream, and OGMMFVRD.

[0122] Table 2 Comparison of online anomaly detection results

[0123]

[0124] It can be seen from Table 2 that compared with the other five algorithms and the offline anomaly detection model based on the LSTM autoencoder, the accuracy of the present invention has been greatly improved. This is because the present invention takes into account multiple feature information of the data in the feature extraction stage, which can better capture the potential features between the data. In addition, for the concept drift phenomenon in the data, the present invention can more accurately detect the concept drift phenomenon by making two judgments, the warning threshold and the drift threshold.

[0125] Figure 3Some detection results of online anomaly detection methods are shown. Figure 3 (a), (b), and (c) are schematic diagrams of the detection results of the angle, acceleration, and speed, respectively. The dotted line in the figure marks the actual abnormal situation, and the shaded part represents the detection result of the method, in which the first part of the data is used for offline modeling, and then the subsequent real-time data is used for online anomaly detection. It can be seen from the figure that all abnormal situations can be detected in the offline stage, but there is a certain false alarm rate. In the online anomaly detection stage, due to the existence of the concept drift phenomenon, the distribution of the data has changed, resulting in changes in the abnormal situation. However, the model is updated through the concept drift adaptive algorithm to adapt to the new data distribution and detect anomalies, and the false alarm rate is low.

[0126] In order to further verify the relative importance of each component in the model, the present invention conducted an ablation experiment, and the model structures were OAD-ACD method, OAD-RNN method, OAD-DDM method, and CDAO method. The OAD-RNN method replaces the LSTM network in offline modeling with the RNN network; the OAD-DDM method performs concept drift detection based on the distribution method; the CDAO method performs adaptive adjustment for partial model training.

[0127] The accuracy, recall rate, F1 score and AUC results of the above four models on the data set are shown in Table 3. The OAD-ACD method achieved the highest F1 score and AUC value. In the offline anomaly detection model training stage, compared with the RNN model, LSTM can capture the time dependency between spatiotemporal sequence data and better extract the potential features between data, which proves the effectiveness of LSTM in the anomaly detection algorithm; in the online anomaly detection stage, the distribution-based concept drift detection algorithm requires a lot of computing time, which has limitations for occasions with high real-time requirements. Since the present invention adopts complete model retraining in the model update stage, it can better adapt to the changing data distribution and meet the accuracy requirements compared with partial retraining.

[0128] Table 3 Ablation experiment

[0129]

[0130] In order to compare the efficiency of online anomaly detection methods, the time taken by different methods to batch process 1000 data is compared. Figure 4It can be seen that different methods have large differences in processing time. Among them, REBM and OGMMFVRD are offline anomaly detection algorithms, but the method of the present invention can still achieve higher accuracy. Compared with the three online anomaly detection algorithms ARCUS, RNN-AD and MemStream, the efficiency of the present invention is still the highest. This is because although the model of the present invention adopts full retraining, it does not use all historical data, so that the model can adapt to the changing data distribution on the basis of meeting the real-time requirements.

[0131] Accordingly, an embodiment of the present invention further provides an online anomaly detection system for spatiotemporal data based on concept drift adaptation. Figure 5 FIG. 1 is a system structure block diagram according to an exemplary embodiment. Figure 5 As shown, the system includes:

[0132] An offline training module 201 is used to perform offline training on the LSTM autoencoder using historical spatiotemporal data to obtain an initial anomaly detection model;

[0133] An updating module 202 is used to determine whether there is a concept drift for the spatiotemporal data received in real time, and to update the anomaly detection model if there is a concept drift;

[0134] The detection module 203 is used to perform anomaly detection on the spatiotemporal data using the updated anomaly detection model to determine whether the current spatiotemporal data is abnormal;

[0135] The output module 204 is used to output the abnormality detection result.

[0136] For ease of explanation, Figure 5 Only the main structure of the system is shown. The system of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0137] In an exemplary embodiment, the present invention further provides an electronic device, the electronic device comprising:

[0138] processor;

[0139] A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are loaded and executed by the processor, the steps of the above-mentioned method for online anomaly detection of spatiotemporal data are implemented.

[0140] Figure 6 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 6As shown, the electronic device 300 may include a processor 3001 and a memory 3002. Optionally, the electronic device 300 may further include a transceiver 3003. The processor 3001, the memory 3002, and the transceiver 3003 may be connected, for example, via a communication bus. The memory 3002 stores computer-readable instructions, which, when executed by the processor 3001, implement the steps of the above-mentioned online anomaly detection method for spatiotemporal data.

[0141] In a specific implementation, as an embodiment, the processor 3001 may include one or more CPUs, such as Figure 6 CPU0 and CPU1 are shown in FIG.

[0142] In a specific implementation, as an embodiment, the electronic device 300 may also include multiple processors, such as Figure 6 3001 and processor 3004 are shown in FIG. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0143] The memory 3002 is used to store the software program for executing the solution of the present invention, and the execution is controlled by the processor 3001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0144] The transceiver 3003 is used to communicate with a network device or a terminal device.

[0145] Optionally, the transceiver 3003 may include a receiver and a transmitter, wherein the receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0146] Optionally, the transceiver 3003 may be integrated with the processor 3001 , or may exist independently and be coupled to the processor 3001 via an interface circuit of the electronic device 300 , which is not specifically limited in the embodiment of the present invention.

[0147] It should be noted that Figure 6 The structure of the electronic device 300 shown in the figure does not constitute a limitation on the electronic device. The actual electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. In addition, the technical effects of the electronic device 300 can refer to the technical effects of the above-mentioned method embodiment, which will not be repeated here.

[0148] In an exemplary embodiment, the present invention further provides a computer-readable storage medium, wherein at least one instruction is stored in the computer-readable storage medium, and the at least one instruction is loaded and executed by a processor to implement the steps of the above-mentioned online anomaly detection method for spatiotemporal data. For example, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0149] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0150] References in the specification to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments", etc. indicate that the described embodiments may include a particular feature, structure, or characteristic, but not every embodiment may include the particular feature, structure, or characteristic. In addition, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the relevant art to implement such feature, structure, or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0151] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0152] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0153] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0154] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0155] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0156] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0157] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0158] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0159] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A concept drift adaptive online anomaly detection method for spatiotemporal data, characterized in that: The following steps are involved: S1. Use historical spatiotemporal data to train the LSTM autoencoder offline to obtain the initial anomaly detection model. The historical spatiotemporal data adopts a car driving data set, including sampling time, longitude, latitude, speed, acceleration, and heading change angle; S2. For the spatiotemporal data received in real time, determine whether there is a concept drift, and if there is a concept drift, update the anomaly detection model; The step S2 specifically includes: Setting a test window and an adaptive window; the test window is used to detect whether there is concept drift in the spatiotemporal data received in real time, and the adaptive window is used to store sample data for updating the anomaly detection model; For the spatiotemporal data received in real time, if the accuracy of the data in the inspection window drops to the warning threshold α, it means that the warning state is reached, and the adaptive window starts to collect the incoming data as sample data that may have concept drift; Afterwards, if the accuracy of the data in the test window continues to drop to the drift threshold β, it indicates that concept drift has occurred, and the anomaly detection model is updated using the sample data with new distribution collected in the adaptive window; If the accuracy of the data in the test window stops decreasing or rises to a normal level in the warning state, it is regarded as a false warning; at this time, the sample data in the adaptive window is released and the monitoring of new concept drift is restarted; S3, using the updated anomaly detection model to perform anomaly detection on the spatiotemporal data to determine whether the current spatiotemporal data is abnormal; S4. Output anomaly detection results.

2. The method for online anomaly detection of spatiotemporal data according to claim 1, characterized in that: The step S1 specifically includes: Normalize and preprocess historical spatiotemporal data; Extract features from the normalized preprocessed historical spatiotemporal data; The historical spatiotemporal data after feature extraction is converted into a window sequence of preset length and input into the LSTM autoencoder for offline training.

3. The method for online anomaly detection of spatiotemporal data according to claim 2, characterized in that: The feature extraction of the normalized preprocessed historical spatiotemporal data specifically includes: For historical spatiotemporal data after normalization preprocessing: The basic features are obtained by using the mean and variance, the spatial semantic features are obtained by using the correlation vector and the difference vector, and the context features are obtained by using the gradient vector; the basic features, the spatial semantic features, and the context features constitute the temporal features; One-hot encoding is used to obtain spatial geographic location features.

4. The method for online anomaly detection of spatiotemporal data according to claim 2, characterized in that: The feature-extracted historical spatiotemporal data is converted into a window sequence of a preset length and input into an LSTM autoencoder for offline training, specifically including: The historical spatiotemporal data after feature extraction is converted into a length of w The window sequence is input into the LSTM autoencoder, and the LSTM autoencoder is used to encode, decode, and reconstruct to obtain a reconstructed sequence; According to the reconstruction error between the reconstructed sequence and the input window sequence, the LSTM autoencoder is trained to obtain the initial anomaly detection model.

5. The method for online anomaly detection of spatiotemporal data according to claim 1, characterized in that: When one of the following two conditions is met, the adaptive window starts to collect sample data with a new distribution: 1) The accuracy of the data in the inspection window drops to a first threshold α; 2) The adaptive window length reaches the preset maximum value ; For α, β, The three parameters are optimized using particle swarm algorithm to obtain the optimal parameter combination for building the online anomaly detection model.

6. The method for online anomaly detection of spatiotemporal data according to claim 1, characterized in that: The step S3 specifically includes: Use the updated anomaly detection model to perform anomaly detection on spatiotemporal data and obtain anomaly scores; For the obtained abnormal scores, the tail of the probability distribution is fitted based on the extreme value theory, and a dynamic threshold is set for judgment, as follows: if t The anomaly score of the spatiotemporal data at time is greater than or equal to t Dynamic threshold at time , it is marked as abnormal data; if t The anomaly score of spatiotemporal data at time is less than t Dynamic threshold at time , it is marked as normal data.

7. A concept drift-based adaptive online anomaly detection system for spatiotemporal data, the system being used to implement the method according to any one of claims 1 to 6, characterized in that: The system comprises: The offline training module is used to perform offline training on the LSTM autoencoder using historical spatiotemporal data to obtain an initial anomaly detection model; An updating module, for determining whether there is a concept drift for the spatiotemporal data received in real time, and updating the anomaly detection model if there is a concept drift; The detection module is used to perform anomaly detection on spatiotemporal data using an updated anomaly detection model to determine whether the current spatiotemporal data is abnormal; The output module is used to output anomaly detection results.

8. An electronic device, characterized in that: The electronic device comprises: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are loaded and executed by the processor, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the at least one instruction is loaded and executed by a processor to implement the method according to any one of claims 1 to 6.

Images