Methods, apparatus and electronic equipment for generating time series data anomaly detection models

Abstract

This disclosure provides a method, apparatus, and electronic device for generating a time-series data anomaly detection model, relating to the field of computer technology, and particularly to the fields of data processing, deep learning, and other artificial intelligence technologies. The specific implementation scheme is as follows: Multiple candidate models and a validation dataset are acquired, wherein each candidate model is used for time-series data reconstruction, and the validation dataset includes sample time-series data and labels, with labels describing whether each data point in the sample time-series data is anomaly; a first time-series data corresponding to the sample time-series data reconstructed by each candidate model and a first recall rate corresponding to each candidate model are determined; a target model is selected from the multiple candidate models based on the first time-series data, the first recall rate, and the validation dataset; and a time-series data anomaly detection model is generated based on the target model.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to the fields of artificial intelligence technology such as data processing and deep learning. Specifically, it relates to a method, apparatus, and electronic device for generating a time-series data anomaly detection model. Background Technology

[0002] Time series data refers to a collection of data arranged in chronological order, where each data point is associated with a specific point in time or time period. Outliers in time series data are points where the pattern is inconsistent, such as sudden increases or decreases, changes in trend, shifts in hierarchy, or exceeding historical maximum / minimum values. Anomaly detection in time series data aims to quickly and accurately identify these outliers. Summary of the Invention

[0003] This disclosure provides a method, apparatus, and electronic device for generating a time-series data anomaly detection model.

[0004] According to a first aspect of this disclosure, a method for generating a time-series data anomaly detection model is provided, comprising:

[0005] Multiple candidate models and validation datasets are obtained, wherein each candidate model is used for time series data reconstruction, and the validation dataset includes sample time series data and labels, wherein the labels are used to describe whether each data in the sample time series data is abnormal;

[0006] Determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model;

[0007] Based on the first time-series data, the first recall rate, and the validation dataset, a target model is selected from multiple candidate models;

[0008] Based on the target model, a time series data anomaly detection model is generated.

[0009] According to a second aspect of this disclosure, a method for detecting anomalies in time-series data is provided, comprising:

[0010] Obtain the time series data to be detected;

[0011] The time series data to be detected is input into the time series data anomaly detection model to obtain the target reconstructed time series data corresponding to the time series data to be detected, wherein the time series data anomaly detection model is generated based on the time series data anomaly detection model generation method described in the first aspect;

[0012] Based on the difference between the time series data to be detected and the target reconstructed time series data, abnormal data in the time series data to be detected are determined.

[0013] According to a third aspect of this disclosure, an apparatus for generating a time-series data anomaly detection model is provided, comprising:

[0014] The acquisition module is used to acquire multiple candidate models and a validation dataset. Each candidate model is used for time series data reconstruction. The validation dataset includes sample time series data and labels. The labels are used to describe whether each data point in the sample time series data is abnormal.

[0015] The determining module is used to determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model;

[0016] The selection module is used to select a target model from multiple candidate models based on the first time series data, the first recall rate, and the validation dataset.

[0017] The generation module is used to generate a time-series data anomaly detection model based on the target model.

[0018] According to a fourth aspect of this disclosure, a time-series data anomaly detection device is provided, comprising:

[0019] The first acquisition module is used to acquire the time series data to be detected;

[0020] The second acquisition module is used to input the time series data to be detected into the time series data anomaly detection model to obtain the target reconstructed time series data corresponding to the time series data to be detected, wherein the time series data anomaly detection model is generated based on the device described in any one of claims 14-23;

[0021] The determination module is used to determine abnormal data in the time series data to be detected based on the difference between the time series data to be detected and the target reconstructed time series data.

[0022] According to a fifth aspect of this disclosure, an electronic device is provided, comprising:

[0023] At least one processor; and

[0024] A memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform either the method for generating a time-series data anomaly detection model as described in the first aspect, or the method for detecting time-series data anomalies as described in the second aspect.

[0026] According to a sixth aspect of this disclosure, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing the computer to perform a method for generating a time-series data anomaly detection model as described in the first aspect, or to perform a time-series data anomaly detection method as described in the second aspect.

[0027] According to a seventh aspect of this disclosure, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the method for generating a time-series data anomaly detection model as described in the first aspect, or are capable of executing the steps of the time-series data anomaly detection method as described in the second aspect.

[0028] The method, apparatus, and electronic equipment for generating time-series data anomaly detection models disclosed herein have the following beneficial effects:

[0029] In this embodiment, multiple candidate models and a validation dataset are first acquired. Then, the first time-series data corresponding to the reconstructed sample time-series data of each candidate model and the first recall rate corresponding to each candidate model are determined. Next, based on the first time-series data, the first recall rate, and the validation dataset, a target model is selected from the multiple candidate models. Finally, a time-series data anomaly detection model is generated based on the target model. Therefore, a target model can be selected from multiple candidate models based on the first time-series data, the first recall rate, and the validation dataset to form a time-series data anomaly detection model with a high recall rate. This allows the time-series data anomaly detection model to integrate the prediction results of the target model, improving the accuracy and reliability of the time-series data anomaly detection model in predicting anomaly data.

[0030] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0031] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0032] Figure 1 This is a flowchart illustrating a method for generating a time-series data anomaly detection model according to an embodiment of this disclosure;

[0033] Figure 2 This is a flowchart illustrating a method for generating a time-series data anomaly detection model according to yet another embodiment of this disclosure;

[0034] Figure 3 This is a flowchart illustrating a method for generating a time-series data anomaly detection model according to yet another embodiment of this disclosure;

[0035] Figure 4 This is a flowchart illustrating a time-series data anomaly detection method according to an embodiment of the present disclosure;

[0036] Figure 5 This is a schematic diagram of the structure of a device for generating a time-series data anomaly detection model according to an embodiment of the present disclosure;

[0037] Figure 6 This is a schematic diagram of the structure of a time-series data anomaly detection device according to another embodiment of the present disclosure;

[0038] Figure 7 This is a block diagram of an electronic device used to implement embodiments of the present disclosure. Detailed Implementation

[0039] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0040] This disclosure relates to the fields of artificial intelligence technology, such as data processing and deep learning. It can be applied to scenarios such as monitoring battery charging status, using sensors to monitor machine operation data to determine if a machine has malfunctioned, monitoring and analyzing pedestrian traffic, and monitoring network traffic.

[0041] Artificial Intelligence (AI) is a new technological science that studies and develops theories, methods, technologies, and application systems to simulate, extend, and expand human intelligence.

[0042] Data processing is the collection, storage, retrieval, processing, transformation, and transmission of data. The fundamental purpose of data processing is to extract and derive valuable and meaningful data from large, potentially disorganized, and difficult-to-understand datasets.

[0043] Deep learning learns the inherent patterns and hierarchical representations of sample data. The information gained during this learning process greatly aids in interpreting data such as text, images, and sound. The ultimate goal of deep learning is to enable machines to possess analytical and learning capabilities similar to humans, allowing them to recognize data such as text, images, and sound.

[0044] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0045] The following description, with reference to the accompanying drawings, outlines a method, apparatus, and electronic device for generating a time-series data anomaly detection model according to embodiments of the present disclosure.

[0046] It should be noted that the execution subject of the time series data anomaly detection model generation method in this embodiment is the time series data anomaly detection model generation device. This device can be implemented by software and / or hardware. This device can be configured in an electronic device, which may include, but is not limited to, a terminal, a server, etc.

[0047] Figure 1 This is a flowchart illustrating a method for generating a time-series data anomaly detection model according to an embodiment of this disclosure.

[0048] like Figure 1 As shown, the method for generating this time-series data anomaly detection model includes:

[0049] S101: Obtain multiple candidate models and validation datasets. Each candidate model is used for time series data reconstruction, and the validation dataset includes sample time series data and labels. The labels are used to describe whether each data point in the sample time series data is abnormal.

[0050] Among them, the candidate model can be a pre-trained model that can be used for time series data reconstruction.

[0051] In some embodiments, a training dataset and multiple initial models are obtained. The training dataset includes third-time-series data, where each data point is normal data. Then, based on the training dataset, each initial model is trained to obtain multiple candidate models. Thus, multiple initial models are trained separately on the same training dataset, allowing each trained candidate model to learn different semantic features of the same data.

[0052] The initial model can be composed of a Patch Time Series Transformer (PatchTST), a time series base model (TimesNet), or a non-stationary transformer, along with a decoding module (for example, a linear layer with the same dimension as the input sequence can be added after the model's output).

[0053] The sample time-series data consists of data sequences arranged in chronological order. It includes both normal and abnormal data, with each data point assigned a label to indicate whether it is abnormal. For example, abnormal data might be labeled 1, while normal data might be labeled 0. Alternatively, abnormal data could be labeled 0, and normal data 1.

[0054] S102: Determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model.

[0055] In some embodiments, sample time series data are input into each candidate model to obtain the first time series data reconstructed by each candidate model.

[0056] After obtaining the first time-series data reconstructed by each candidate model, the difference between each data point in the first time-series data and the corresponding data point in the sample time-series data can be determined. If the difference value corresponding to any data point in the first time-series data is greater than the difference threshold, that data point is determined as predicted outlier data. The first total number of predicted outliers and the second total number of labeled outliers are determined. Finally, the ratio of the first total number to the second total number is determined as the first recall rate. Thus, the recall rate of each candidate model for outlier data can be accurately determined.

[0057] Specifically, the distance or the square of the distance between each data point in the first time series data and the corresponding data point in the sample time series data can be determined as the corresponding difference value. This disclosure does not limit this aspect.

[0058] In some embodiments, a first recall rate corresponding to each candidate model can be determined when the precision is 90%.

[0059] S103: Select the target model from multiple candidate models based on the first time series data, the first recall rate, and the validation dataset.

[0060] In some embodiments, a first model with a first recall rate greater than a preset threshold can be selected first, and then the first model can be freely combined to obtain multiple model combinations. The first time series data corresponding to the first model in each model combination is fused to obtain fused time series data corresponding to each model combination. Based on the fused time series data and the validation dataset, the third recall rate corresponding to each model combination is determined, and the candidate model in the model combination with the highest third recall rate is determined as the target model.

[0061] Any data fusion method can be used to fuse the first time-series data corresponding to the first model in each model combination. This disclosure does not limit this.

[0062] Specifically, based on the fused time-series data and the validation dataset, the specific implementation form of the third recall rate corresponding to each model combination is determined, which can be referred to the specific description of determining the first recall rate of each candidate model.

[0063] S104: Generate a time series data anomaly detection model based on the target model.

[0064] Specifically, the target model can be integrated into a time-series data anomaly detection model.

[0065] In some embodiments, the time-series data anomaly detection model may further include weights for each target model. The sum of the weights for each target model is 1. Optionally, the weights for each target model may be the same or different. This disclosure does not limit this.

[0066] In some embodiments, the target weight for each target model can be determined based on the first recall rate corresponding to each target model. The higher the first recall rate, the greater the corresponding target weight.

[0067] Optionally, when there are multiple target models, the first recall rates corresponding to the target models can be summed to obtain a second value. Then, the ratio of the first recall rate to the second value is used to determine the target weight for each target model. Finally, the target models are integrated into a time-series data anomaly detection model, where the time-series data anomaly detection model includes the target weights corresponding to the target models. Therefore, the target weight for each target model can be determined more accurately based on its first recall rate.

[0068] In this embodiment, multiple candidate models and a validation dataset are first acquired. Then, the first time-series data corresponding to the reconstructed sample time-series data of each candidate model and the first recall rate corresponding to each candidate model are determined. Next, based on the first time-series data, the first recall rate, and the validation dataset, a target model is selected from the multiple candidate models. Finally, a time-series data anomaly detection model is generated based on the target model. Therefore, a target model can be selected from multiple candidate models based on the first time-series data, the first recall rate, and the validation dataset to form a time-series data anomaly detection model with a high recall rate. This allows the time-series data anomaly detection model to integrate the prediction results of the target model, improving the accuracy and reliability of the time-series data anomaly detection model in predicting anomaly data.

[0069] Figure 2 This is a flowchart illustrating a method for generating a time-series data anomaly detection model according to yet another embodiment of this disclosure;

[0070] like Figure 2 As shown, the method for generating this time-series data anomaly detection model includes:

[0071] S201: Obtain multiple candidate models and validation datasets. Each candidate model is used for time series data reconstruction, and the validation dataset includes sample time series data and labels. The labels are used to describe whether each data point in the sample time series data is abnormal.

[0072] S202: Determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model.

[0073] The specific implementation of steps S201 and S202 can be found in the detailed descriptions of other embodiments in this disclosure, and will not be described in detail here.

[0074] S203: Determine multiple ensemble models, wherein each ensemble model is obtained by integrating at least one candidate model.

[0075] In some embodiments, one or more candidate models can be randomly selected to obtain an ensemble model.

[0076] In some embodiments, multiple candidate models with high first recall rates can be freely combined to obtain multiple ensemble models.

[0077] S204: Based on the first recall rate, the first time series data reconstructed from the candidate models in each ensemble model are fused to obtain the second time series data corresponding to each ensemble model.

[0078] In this embodiment of the disclosure, a first weight corresponding to a candidate model in the ensemble model can be determined based on a first recall rate. The sum of the first weights corresponding to the candidate models in the ensemble model is 1. The higher the first recall rate, the higher the corresponding first weight.

[0079] The first weight can be used to indicate the fusion ratio of the first time series data corresponding to the candidate models in the ensemble model.

[0080] For example, if the ensemble model includes candidate model A and candidate model B, and the first recall of candidate model A is less than the first recall of candidate model B, then the first weight of candidate model A can be 0.4, and the first weight of candidate model B can be 0.6.

[0081] In some embodiments, the first recall rates corresponding to each candidate model in the ensemble model can be summed to obtain a first value. Then, the ratio of the first recall rate to the first value for each candidate model in the ensemble model is determined as the first weight for each candidate model. Finally, based on the first weights, the reconstructed first time-series data from each candidate model in the ensemble model are fused to obtain the second time-series data corresponding to the ensemble model. Thus, by using the ratio of the first recall rate to the first value for each candidate model in the ensemble model, the fusion weights for each candidate model in the ensemble model can be determined more accurately.

[0082] S205: Determine the second recall rate for each ensemble model based on the second time series data and the validation dataset.

[0083] Specifically, the difference between each data point in the second time series data and the corresponding data point in the sample time series data is determined. If the difference between any data point in the second time series data and the corresponding data point is greater than the difference threshold, then any data point is determined to be an outlier predicted by the ensemble model. The third total number of outlier data predicted by the ensemble model and the second total number of outlier data labeled are determined. Finally, the ratio of the third total number to the second total number is determined as the second recall rate corresponding to the ensemble model.

[0084] S206: Select the candidate model from the ensemble model with the second highest recall as the target model.

[0085] It should be noted that a higher second recall rate indicates a higher accuracy of the ensemble model in predicting outlier data. Therefore, the candidate model in the ensemble model with the highest second recall rate is selected as the target model.

[0086] S207: Generate a time series data anomaly detection model based on the target model.

[0087] In this embodiment of the disclosure, the ensemble model with the highest second recall rate is the time series data anomaly detection model.

[0088] In this embodiment, after determining the first time-series data corresponding to the sample time-series data reconstructed by each candidate model and the first recall rate corresponding to each candidate model, multiple ensemble models are determined. Based on the first recall rate, the first time-series data reconstructed by the candidate models in each ensemble model are fused to obtain the second time-series data corresponding to each ensemble model. Then, based on the second time-series data and the validation dataset, the second recall rate corresponding to each ensemble model is determined. The candidate model in the ensemble model with the highest second recall rate is determined as the target model. Finally, a time-series data anomaly detection model is generated based on the target model. Thus, based on the first recall rate, the first time-series data reconstructed by the candidate models in the ensemble models can be fused to accurately determine the second time-series data corresponding to each ensemble model, and further accurately determine the second recall rate corresponding to each ensemble model. This allows the ensemble model with the optimal second recall rate to be selected to generate the time-series data anomaly detection model, thereby further improving the accuracy and reliability of the time-series data anomaly detection model in predicting anomaly data.

[0089] Figure 3 This is a flowchart illustrating a method for generating a time-series data anomaly detection model according to yet another embodiment of this disclosure;

[0090] like Figure 3 As shown, the method for generating this time-series data anomaly detection model includes:

[0091] S301: Obtain multiple candidate models and validation datasets. Each candidate model is used for time series data reconstruction, and the validation dataset includes sample time series data and labels. The labels are used to describe whether each data point in the sample time series data is abnormal.

[0092] S302: Determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model.

[0093] S303: Determine multiple ensemble models, wherein each ensemble model is obtained by integrating at least one candidate model.

[0094] S304: Based on the first recall rate, the first time series data reconstructed from the candidate models in each ensemble model are fused to obtain the second time series data corresponding to each ensemble model.

[0095] S305: Determine the second recall rate for each ensemble model based on the second time series data and the validation dataset.

[0096] The specific implementation of steps S301 and S302 can be found in the detailed descriptions of other embodiments in this disclosure, and will not be described in detail here.

[0097] S306: Update the ensemble model and determine the second recall corresponding to the updated ensemble model.

[0098] In some embodiments, the ensemble model can be updated based on a genetic algorithm. Therefore, using a genetic algorithm can increase the diversity of the ensemble model and improve the accuracy of the generated time-series data anomaly detection model in detecting anomalies.

[0099] For example, there are 5 candidate models: candidate model 1, candidate model 2, candidate model 3, candidate model 4, and candidate model 5. Each candidate model has two possibilities: selected or not selected. If selected is marked as 1 and not selected is marked as 0, then each ensemble model can correspond to a 01 sequence. If the sequence corresponding to the ensemble model is 00110, it means that candidate model 3 and candidate model 4 are selected, and candidate model 1, candidate model 2, and candidate model 5 are not selected. The ensemble model includes candidate model 3 and candidate model 4.

[0100] In some embodiments, corresponding elements in two sequences with ensemble models can be swapped to obtain a new ensemble model. For example, if the sequence corresponding to ensemble model A is 10110 and the sequence corresponding to ensemble model B is 00101, the first element of the sequence corresponding to ensemble model A can be swapped with the first element of the sequence corresponding to ensemble model B to obtain the updated ensemble models 00110 and 10101.

[0101] In some embodiments, any element in the ensemble model can be replaced to obtain an updated ensemble model. For example, if the sequence corresponding to ensemble model A is 10110, then the third element can be replaced to obtain an updated ensemble model of 10010.

[0102] In some embodiments, candidate models with higher first recall rates in the ensemble model can be retained. For example, the sequence corresponding to ensemble model A is 10110. If the first recall rates of candidate models 1 and 3 are higher than those of candidate model 4, then candidate models 1 and 3 can be retained, and the second, fourth, or fifth element in the sequence can be changed to obtain a new ensemble model.

[0103] In some embodiments, updating the integrated model may include at least one of the following:

[0104] Replace the candidate model with the lowest first recall rate in the ensemble model with other candidate models;

[0105] Remove the candidate model with the lowest first recall rate from the ensemble model;

[0106] Add other candidate models to the ensemble model;

[0107] Swap any of the candidate models in the two ensemble models.

[0108] For example, there are 5 candidate models: candidate model 1, candidate model 2, candidate model 3, candidate model 4, and candidate model 5. If the ensemble model A includes candidate model 1, candidate model 3, and candidate model 5, then candidate model 5 has the lowest first recall rate.

[0109] Candidate model 5 can then be replaced with candidate model 4 and / or candidate model 2 to obtain the updated ensemble model.

[0110] Alternatively, delete candidate model 5 from ensemble model A to obtain the updated ensemble model. Alternatively, add candidate model 2 and / or candidate model 4 to ensemble model A.

[0111] Alternatively, if ensemble model B includes candidate model 2, candidate model 4, and candidate model 5, then candidate model 1 in ensemble model A can be swapped with candidate model 2 in ensemble model B to obtain an updated ensemble model C that includes candidate model 2, candidate model 3, and candidate model 5; and ensemble model D that includes candidate model 1, candidate model 4, and candidate model 5.

[0112] Therefore, by exchanging, deleting, or adding candidate models in the ensemble model, the diversity of the ensemble model can be increased, thereby improving the accuracy of the generated time-series data anomaly detection model in detecting anomalies.

[0113] In some embodiments, only ensemble models with a second recall rate higher than a preset threshold can be updated, thereby reducing computational load and improving the efficiency of generating time-series data anomaly detection models.

[0114] S307: Update the updated ensemble model until the preset iteration stopping condition is met, and determine the candidate model in the ensemble model with the highest second recall as the target model.

[0115] In some embodiments, the iteration stopping condition can be any of the following: the number of iterations reaches a preset number; the difference between the maximum second recall in the result of the nth iteration and the maximum second recall in each of the previous m iterations is less than a first threshold, where m is a positive integer and n is a positive integer greater than m.

[0116] In some embodiments, the preset number of attempts can be determined based on the number of candidate models. The more candidate models there are, the greater the preset number of attempts should be.

[0117] For example, if the preset number of iterations is 50, then 50 iterations can be performed to obtain the ensemble model with the second highest recall rate among the 50 iterations.

[0118] For example, if m is 5, and the difference between the maximum second recall in the nth iteration and the maximum second recall in the (n-1)th iteration is less than the first threshold, the difference between the maximum second recall in the nth iteration and the maximum second recall in the (n-2)th iteration is less than the first threshold, the difference between the maximum second recall in the nth iteration and the maximum second recall in the (n-3)th iteration is less than the first threshold, the difference between the maximum second recall in the nth iteration and the maximum second recall in the (n-4)th iteration is less than the first threshold, and the difference between the maximum second recall in the nth iteration and the maximum second recall in the (n-5)th iteration is less than the first threshold, then the iteration update is stopped, and the ensemble model with the highest second recall is obtained.

[0119] Understandably, if the maximum second recall does not change significantly in the results of multiple consecutive iterations, continuing to iterate and update will not result in a significant increase in the maximum second recall. Therefore, iterative updates can be stopped to avoid wasting computational resources.

[0120] In this embodiment of the disclosure, by setting an iteration stop condition, the number of iterations can be controlled, the iteration update can be stopped in time, the consumption of computing resources can be reduced, and the efficiency of generating a time series data anomaly detection model can be improved.

[0121] S308: Generate a time series data anomaly detection model based on the target model.

[0122] In this embodiment, after determining the first time-series data corresponding to the sample time-series data reconstructed by each candidate model and the first recall rate corresponding to each candidate model, multiple ensemble models are determined. Based on the first recall rate, the first time-series data reconstructed by the candidate models in each ensemble model are fused to obtain the second time-series data corresponding to each ensemble model. Then, based on the second time-series data and the validation dataset, the second recall rate corresponding to each ensemble model is determined. The ensemble model is then updated, and the second recall rate corresponding to the updated ensemble model is determined. The updated ensemble model is updated again until a preset iteration stopping condition is reached. The candidate model in the ensemble model with the highest second recall rate is determined as the target model. Finally, a time-series data anomaly detection model is generated based on the target model. Therefore, after determining the second recall rate corresponding to each ensemble model, the ensemble model can be iteratively updated, and the second recall rate corresponding to the updated ensemble model can be determined. This allows for the acquisition of the ensemble model with the highest second recall rate, generating a time-series data anomaly detection model, and further improving the accuracy and reliability of the time-series data anomaly detection model in predicting anomaly data.

[0123] Figure 4This is a flowchart illustrating a time-series data anomaly detection method according to yet another embodiment of this disclosure;

[0124] like Figure 4 As shown, this time-series data anomaly detection method includes:

[0125] S401: Obtain the timing data to be detected.

[0126] Among them, the time series data to be detected can be the time series data for which anomaly detection is to be performed.

[0127] S402: Input the time series data to be detected into the time series data anomaly detection model to obtain the target reconstructed time series data corresponding to the time series data to be detected.

[0128] The time-series data anomaly detection model is generated based on the generation method of the time-series data anomaly detection model in other embodiments of this disclosure.

[0129] In some embodiments, when the time series data anomaly detection model includes multiple target models, the time series data to be detected can be input into each target model to obtain the initial reconstructed time series data output by each target model. Then, the multiple initial reconstructed time series data are fused to obtain the target reconstructed time series data. This allows the initial reconstructed time series data output by multiple target models to be combined, reducing the bias of individual models and thus obtaining more reliable and accurate target reconstructed time series data.

[0130] In some embodiments, target weights corresponding to each target model are obtained. Then, based on the target weights corresponding to each target model, multiple initial reconstruction time series data are fused to obtain target reconstruction time series data. Thus, multiple initial reconstruction time series data can be fused based on the target weights corresponding to the target models, thereby further improving the reliability and accuracy of the determined target reconstruction time series data.

[0131] In some embodiments, the same weight value may be set for each target model, and then multiple initial reconstruction time series data are averaged and fused to obtain target reconstruction time series data.

[0132] S403: Based on the difference between the time series data to be detected and the target reconstructed time series data, identify the abnormal data in the time series data to be detected.

[0133] Specifically, the difference between each data point in the target reconstructed time series data and the corresponding data point in the time series data to be detected is determined. If the difference value corresponding to any data point in the first time series data is greater than the difference threshold, then any data point is determined to be an abnormal data point in the time series data to be detected.

[0134] Specifically, the distance or the square of the distance between each data point in the target reconstructed time series data and the corresponding data point in the time series data to be detected can be determined as the corresponding difference value. This disclosure does not limit this aspect.

[0135] In this embodiment of the disclosure, time series data to be detected is acquired; the time series data to be detected is input into a time series data anomaly detection model to obtain target reconstructed time series data corresponding to the time series data to be detected; finally, based on the difference between the time series data to be detected and the target reconstructed time series data, abnormal data in the time series data to be detected is determined. Therefore, abnormal data in the time series data to be detected can be accurately determined using a pre-generated time series data anomaly detection model.

[0136] Figure 5 This is a schematic diagram of the structure of a device for generating a time-series data anomaly detection model according to an embodiment of the present disclosure;

[0137] like Figure 5 As shown, the generation device 500 for the time series data anomaly detection model includes:

[0138] The acquisition module 501 is used to acquire multiple candidate models and validation datasets. Each candidate model is used for time series data reconstruction, and the validation dataset includes sample time series data and labels. The labels are used to describe whether each data in the sample time series data is abnormal.

[0139] The determination module 502 is used to determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model;

[0140] Selection module 503 is used to select a target model from multiple candidate models based on the first time series data, the first recall rate and the validation dataset;

[0141] The generation module 504 is used to generate a time series data anomaly detection model based on the target model.

[0142] In some embodiments of this disclosure, the selection module 503 is configured to:

[0143] Multiple ensemble models are identified, where each ensemble model is obtained by integrating at least one candidate model;

[0144] Based on the first recall rate, the first time series data reconstructed from the candidate models in each ensemble model are fused to obtain the second time series data corresponding to each ensemble model.

[0145] Based on the second time-series data and the validation dataset, determine the second recall rate for each ensemble model;

[0146] The candidate model from the ensemble model with the highest second recall rate is selected as the target model.

[0147] In some embodiments of this disclosure, the selection module 503 is configured to:

[0148] The first recall rate corresponding to each candidate model in the ensemble model is added together to obtain the first value;

[0149] The ratio of the first recall rate to the first numerical value corresponding to each candidate model in the ensemble model is determined as the first weight corresponding to each candidate model in the ensemble model.

[0150] Based on the first weight corresponding to each candidate model in the ensemble model, the first time series data reconstructed by each candidate model in the ensemble model are fused to obtain the second time series data corresponding to the ensemble model.

[0151] In some embodiments of this disclosure, an update module is further included, for:

[0152] Update the ensemble model and determine the second recall corresponding to the updated ensemble model;

[0153] The updated ensemble model is updated until the preset iteration stopping condition is reached, and the candidate model in the ensemble model with the highest second recall rate is determined as the target model.

[0154] In some embodiments of this disclosure, the update module is configured to:

[0155] The ensemble model is updated based on a genetic algorithm.

[0156] In some embodiments of this disclosure, the update module is configured to:

[0157] Replace the candidate model with the lowest first recall rate in the ensemble model with other candidate models;

[0158] Remove the candidate model with the lowest first recall rate from the ensemble model;

[0159] Add other candidate models to the ensemble model;

[0160] Swap any of the candidate models in the two ensemble models.

[0161] In some embodiments of this disclosure, the iteration stopping condition is any one of the following:

[0162] The preset number of iterations has been reached;

[0163] The difference between the maximum second recall in the nth iteration and the maximum second recall in each of the previous m iterations is less than a first threshold, where m is a positive integer and n is a positive integer greater than m.

[0164] In some embodiments of this disclosure, the generation module 504 is configured to:

[0165] When there are multiple target models, the first recall rates corresponding to the target models are added together to obtain the second value;

[0166] The ratio of the first recall rate to the second value corresponding to the target model is determined as the target weight corresponding to the target model.

[0167] The target model is integrated into a time series data anomaly detection model, which includes the target weights corresponding to the target model.

[0168] In some embodiments of this disclosure, the determining module 502 is configured to:

[0169] Input the sample time series data into each candidate model to obtain the first time series data reconstructed by each candidate model;

[0170] Determine the difference between each data point in the first time series data and the corresponding data point in the sample time series data;

[0171] If the difference value corresponding to any data in the first time series data is greater than the difference threshold, then any data is identified as an outlier in the prediction.

[0172] Determine the first total number of predicted outliers and the second total number of labeled outliers;

[0173] The ratio of the first total quantity to the second total quantity is determined as the first recall rate.

[0174] In some embodiments of this disclosure, the acquisition module 501 is configured to:

[0175] Obtain the training dataset and multiple initial models. The training dataset includes third-time series data, and each data point in the third-time series data is normal data.

[0176] Based on the training dataset, each initial model is trained to obtain multiple candidate models.

[0177] It should be noted that the aforementioned explanation of the method for generating the time series data anomaly detection model also applies to the device for generating the time series data anomaly detection model in this embodiment, and will not be repeated here.

[0178] In this embodiment, multiple candidate models and a validation dataset are first acquired. Then, the first time-series data corresponding to the reconstructed sample time-series data of each candidate model and the first recall rate corresponding to each candidate model are determined. Next, based on the first time-series data, the first recall rate, and the validation dataset, a target model is selected from the multiple candidate models. Finally, a time-series data anomaly detection model is generated based on the target model. Therefore, a target model can be selected from multiple candidate models based on the first time-series data, the first recall rate, and the validation dataset to form a time-series data anomaly detection model with a high recall rate. This allows the time-series data anomaly detection model to integrate the prediction results of the target model, improving the accuracy and reliability of the time-series data anomaly detection model in predicting anomaly data.

[0179] Figure 6 This is a schematic diagram of the structure of a time-series data anomaly detection device according to another embodiment of the present disclosure;

[0180] like Figure 6 As shown, the time-series data anomaly detection device 600 includes:

[0181] The first acquisition module 601 is used to acquire the time series data to be detected;

[0182] The second acquisition module 602 is used to input the time series data to be detected into the time series data anomaly detection model in order to obtain the target reconstructed time series data corresponding to the time series data to be detected. The time series data anomaly detection model is generated by a generation device based on the time series data anomaly detection model.

[0183] The determination module 603 is used to determine abnormal data in the time series data to be detected based on the difference between the time series data to be detected and the target reconstructed time series data.

[0184] In some embodiments of this disclosure, the second acquisition module 602 is configured to:

[0185] When the time series data anomaly detection model includes multiple target models, the time series data to be detected is input into each target model to obtain the initial reconstructed time series data output by each target model;

[0186] Multiple initial reconstruction time series data are fused together to obtain the target reconstruction time series data.

[0187] In some embodiments of this disclosure, the second acquisition module 602 is configured to:

[0188] Obtain the target weights corresponding to each target model;

[0189] Based on the target weights corresponding to each target model, multiple initial reconstruction time series data are fused to obtain target reconstruction time series data.

[0190] It should be noted that the foregoing explanation of the time-series data anomaly detection method also applies to the time-series data anomaly detection device of this embodiment, and will not be repeated here.

[0191] In this embodiment of the disclosure, time series data to be detected is acquired; the time series data to be detected is input into a time series data anomaly detection model to obtain target reconstructed time series data corresponding to the time series data to be detected; finally, based on the difference between the time series data to be detected and the target reconstructed time series data, abnormal data in the time series data to be detected is determined. Therefore, abnormal data in the time series data to be detected can be accurately determined using a pre-generated time series data anomaly detection model.

[0192] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0193] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0194] like Figure 7 As shown, device 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 702 or a computer program loaded from storage unit 708 into random access memory (RAM) 703. RAM 703 may also store various programs and data required for the operation of device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via bus 704. Input / output (I / O) interface 705 is also connected to bus 704.

[0195] Multiple components in device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of monitors, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows device 700 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0196] The computing unit 701 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the method for generating a time-series data anomaly detection model or a time-series data anomaly detection method. For example, in some embodiments, the method for generating a time-series data anomaly detection model or a time-series data anomaly detection method can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the method for generating a time-series data anomaly detection model or a time-series data anomaly detection method described above can be performed. Alternatively, in other embodiments, the computing unit 701 may be configured in any other suitable manner (e.g., by means of firmware) to perform a method for generating a time-series data anomaly detection model or a time-series data anomaly detection method.

[0197] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0198] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0199] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0200] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0201] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, and blockchain networks.

[0202] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service ecosystem, addressing the shortcomings of traditional physical hosts and VPS (Virtual Private Server, or simply "VPS") services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0203] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0204] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified. In the description of this disclosure, the words "if" and "suppose" as used may be interpreted as "when," "when," "in response to determination," or "in the circumstances."

[0205] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for generating a time-series data anomaly detection model, comprising: Multiple candidate models and validation datasets are obtained. Each candidate model is used for time series data reconstruction. The validation dataset includes sample time series data and labels. The labels are used to describe whether the machine operation data in the sample time series data is abnormal. The sample time series data is a data sequence in which the machine operation data obtained by sensor monitoring is arranged in time order. Determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model; Based on the first time-series data, the first recall rate, and the validation dataset, a target model is selected from multiple candidate models; Based on the target model, a time series data anomaly detection model is generated, which determines whether the machine has malfunctioned.

2. The method according to claim 1, wherein, The step of selecting a target model from multiple candidate models based on the first time-series data, the first recall rate, and the validation dataset includes: Multiple ensemble models are determined, wherein each ensemble model is obtained by integrating at least one of the candidate models; Based on the first recall rate, the first time series data reconstructed from the candidate models in each ensemble model are fused to obtain the second time series data corresponding to each ensemble model. Based on the second time-series data and the validation dataset, determine the second recall rate corresponding to each ensemble model; The candidate model in the ensemble model with the highest second recall rate is determined as the target model.

3. The method according to claim 2, wherein, The step of fusing the first time-series data reconstructed from the candidate models in each ensemble model based on the first recall rate to obtain the second time-series data corresponding to each ensemble model includes: The first recall rate corresponding to each candidate model in the ensemble model is added together to obtain the first value; The ratio of the first recall rate to the first value for each candidate model in the ensemble model is determined as the first weight for each candidate model in the ensemble model. Based on the first weight corresponding to each candidate model in the ensemble model, the first time series data reconstructed by each candidate model in the ensemble model are fused to obtain the second time series data corresponding to the ensemble model.

4. The method according to claim 2, wherein, After determining the second recall rate corresponding to each ensemble model based on the second time-series data and the validation dataset, the method further includes: The ensemble model is updated, and the second recall rate corresponding to the updated ensemble model is determined. The updated ensemble model is updated until a preset iteration stop condition is met, and the candidate model in the ensemble model with the highest second recall rate is determined as the target model.

5. The method according to claim 4, wherein, The updating of the integrated model includes: The ensemble model is updated based on a genetic algorithm.

6. The method according to claim 4, wherein, Updating the integrated model includes at least one of the following: Replace the candidate model with the lowest first recall rate in the ensemble model with other candidate models; Delete the candidate model with the lowest first recall rate in the ensemble model; Add other candidate models to the ensemble model; Swap any of the candidate models in the two ensemble models.

7. The method according to claim 4, wherein, The iteration stopping condition is any one of the following: The preset number of iterations has been reached; The difference between the maximum second recall in the nth iteration and the maximum second recall in each of the previous m iterations is less than a first threshold, where m is a positive integer and n is a positive integer greater than m.

8. The method according to any one of claims 1-7, wherein, The step of generating a time-series data anomaly detection model based on the target model includes: When there are multiple target models, the first recall rates corresponding to the target models are added together to obtain the second value; The ratio of the first recall rate corresponding to the target model to the second value is determined as the target weight corresponding to the target model; The target model is integrated into the time series data anomaly detection model, wherein the time series data anomaly detection model includes the target weights corresponding to the target model.

9. The method according to any one of claims 1-7, wherein, The step of determining the first time series data corresponding to the sample time series data reconstructed by each candidate model and the first recall rate corresponding to each candidate model includes: The sample time series data is input into each of the candidate models to obtain the first time series data reconstructed by each candidate model; Determine the difference between each data point in the first time series data and the corresponding data point in the sample time series data; If the difference value corresponding to any data in the first time series data is greater than the difference threshold, then the data is determined to be the predicted abnormal data. Determine a first total number of predicted abnormal data and a second total number of abnormal data labeled with tags; The ratio of the first total quantity to the second total quantity is determined as the first recall rate.

10. The method according to any one of claims 1-7, wherein, The process of obtaining multiple candidate models includes: Obtain a training dataset and multiple initial models, wherein the training dataset includes third time series data, and each data point in the third time series data is normal data; Based on the training dataset, each of the initial models is trained to obtain multiple candidate models.

11. A method for detecting anomalies in time-series data, comprising: Obtain the time series data to be detected; The time series data to be detected is input into the time series data anomaly detection model to obtain the target reconstructed time series data corresponding to the time series data to be detected, wherein the time series data anomaly detection model is generated based on the method described in any one of claims 1-10; Based on the difference between the time series data to be detected and the target reconstructed time series data, abnormal data in the time series data to be detected are determined.

12. The method according to claim 11, wherein, The step of inputting the time series data to be detected into the time series data anomaly detection model to obtain the target reconstructed time series data corresponding to the time series data to be detected includes: When the time series data anomaly detection model includes multiple target models, the time series data to be detected is input into each of the target models to obtain the initial reconstructed time series data output by each target model; Multiple initial reconstruction time series data are fused together to obtain the target reconstruction time series data.

13. The method according to claim 12, wherein, The step of fusing multiple initial reconstruction time series data to obtain the target reconstruction time series data includes: Obtain the target weights corresponding to each of the target models; Based on the target weights corresponding to each target model, multiple initial reconstruction time series data are fused to obtain the target reconstruction time series data.

14. An apparatus for generating a time-series data anomaly detection model, comprising: The acquisition module is used to acquire multiple candidate models and a validation dataset. Each candidate model is used for time series data reconstruction. The validation dataset includes sample time series data and labels. The labels are used to describe whether the machine operation data in the sample time series data is abnormal. The sample time series data is a data sequence of machine operation data obtained by sensor monitoring arranged in time order. The determining module is used to determine the first time series data corresponding to the sample time series data reconstructed by each candidate model, and the first recall rate corresponding to each candidate model; The selection module is used to select a target model from multiple candidate models based on the first time series data, the first recall rate, and the validation dataset. The generation module is used to generate a time-series data anomaly detection model based on the target model. The time-series data anomaly detection model is used to determine whether the machine has malfunctioned.

15. The apparatus according to claim 14, wherein, The selection module is used for: Multiple ensemble models are determined, wherein each ensemble model is obtained by integrating at least one of the candidate models; Based on the first recall rate, the first time series data reconstructed from the candidate models in each ensemble model are fused to obtain the second time series data corresponding to each ensemble model. Based on the second time-series data and the validation dataset, determine the second recall rate corresponding to each ensemble model; The candidate model in the ensemble model with the highest second recall rate is determined as the target model.

16. The apparatus according to claim 15, wherein, The selection module is used for: The first recall rate corresponding to each candidate model in the ensemble model is added together to obtain the first value; The ratio of the first recall rate to the first value for each candidate model in the ensemble model is determined as the first weight for each candidate model in the ensemble model. Based on the first weight corresponding to each candidate model in the ensemble model, the first time series data reconstructed by each candidate model in the ensemble model are fused to obtain the second time series data corresponding to the ensemble model.

17. The apparatus according to claim 16, wherein, It also includes an update module for: The ensemble model is updated, and the second recall rate corresponding to the updated ensemble model is determined. The updated ensemble model is updated until a preset iteration stop condition is met, and the candidate model in the ensemble model with the highest second recall rate is determined as the target model.

18. The apparatus according to claim 17, wherein, The update module is used for: The ensemble model is updated based on a genetic algorithm.

19. The apparatus according to claim 17, wherein, The update module is used for: Replace the candidate model with the lowest first recall rate in the ensemble model with other candidate models; Delete the candidate model with the lowest first recall rate in the ensemble model; Add other candidate models to the ensemble model; Swap any of the candidate models in the two ensemble models.

20. The apparatus according to claim 17, wherein, The iteration stopping condition is any one of the following: The preset number of iterations has been reached; The difference between the maximum second recall in the nth iteration and the maximum second recall in each of the previous m iterations is less than a first threshold, where m is a positive integer and n is a positive integer greater than m.

21. The apparatus according to any one of claims 14-20, wherein, The generation module is used for: When there are multiple target models, the first recall rates corresponding to the target models are added together to obtain the second value; The ratio of the first recall rate corresponding to the target model to the second value is determined as the target weight corresponding to the target model; The target model is integrated into the time series data anomaly detection model, wherein the time series data anomaly detection model includes the target weights corresponding to the target model.

22. The apparatus according to any one of claims 14-20, wherein, The determining module is used for: The sample time series data is input into each of the candidate models to obtain the first time series data reconstructed by each candidate model; Determine the difference between each data point in the first time series data and the corresponding data point in the sample time series data; If the difference value corresponding to any data in the first time series data is greater than the difference threshold, then the data is determined to be the predicted abnormal data. Determine a first total number of predicted abnormal data and a second total number of abnormal data labeled with tags; The ratio of the first total quantity to the second total quantity is determined as the first recall rate.

23. The apparatus according to any one of claims 14-20, wherein, The acquisition module is used for: Obtain a training dataset and multiple initial models, wherein the training dataset includes third time series data, and each data point in the third time series data is normal data; Based on the training dataset, each of the initial models is trained to obtain multiple candidate models.

24. A time-series data anomaly detection device, comprising: The first acquisition module is used to acquire the time series data to be detected; The second acquisition module is used to input the time series data to be detected into the time series data anomaly detection model to obtain the target reconstructed time series data corresponding to the time series data to be detected, wherein the time series data anomaly detection model is generated based on the device described in any one of claims 14-23; The determination module is used to determine abnormal data in the time series data to be detected based on the difference between the time series data to be detected and the target reconstructed time series data.

25. The apparatus according to claim 24, wherein, The second acquisition module is used for: When the time series data anomaly detection model includes multiple target models, the time series data to be detected is input into each of the target models to obtain the initial reconstructed time series data output by each target model; Multiple initial reconstruction time series data are fused together to obtain the target reconstruction time series data.

26. The apparatus according to claim 25, wherein, The second acquisition module is used for: Obtain the target weights corresponding to each of the target models; Based on the target weights corresponding to each target model, multiple initial reconstruction time series data are fused to obtain the target reconstruction time series data.

27. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method of any one of claims 1-10, or to perform the method of any one of claims 11-13.

28. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method of any one of claims 1-10, or to perform the method of any one of claims 11-13.

29. A computer program product comprising computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-10, or are capable of performing the steps of the method according to any one of claims 11-13.

Images