A multidimensional time series anomaly detection method based on standard Gini index construction

Abstract

The application discloses a multi-dimensional time sequence anomaly detection method based on standard Gini index composition, and belongs to the technical field of time sequence anomaly detection. In view of the problem that the existing time sequence anomaly detection method cannot learn the relationship between discrete values and continuous values, when measuring the similarity of sensors, the continuous variable is discretized, and the similarity value between the sensors is obtained by calculating the standard Gini index between the two sensors. The traditional Gini index has a multi-value bias problem, that is, it is biased to give a score to a value with more values and higher attributes, and the standard Gini index can effectively alleviate this problem. The standard Gini index can effectively depict the similarity between sensors with different value types; and the application gives each sensor an embedding vector, which can represent the unique characteristics of each sensor. When reconstructing the data, the embedding vector and the corresponding transformation feature are connected, so that the original data can be better reconstructed.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of time series anomaly detection, and particularly relates to a multi-dimensional time series anomaly detection method based on standard Gini index graphing. BACKGROUND

[0002] Time series anomaly detection refers to a process of identifying abnormal events or behaviors from normal time series. Anomaly detection has different meanings in different fields. For example, in the field of network security, abnormal patterns or behaviors can be detected by monitoring network traffic and other data to discover security threats in a timely manner. In the medical field, abnormal areas can be detected by anomaly algorithms, which can help doctors diagnose diseases more accurately. Existing time series anomaly detection methods are mainly based on traditional machine learning and deep learning. When the target system becomes complex, traditional machine methods such as support vector machines and density-based methods face limitations, while deep learning methods learn complex dynamics in data without making assumptions about potential patterns in data, such as Generative Adversarial Networks (GAN), Variational Autoencoder (VAE), Transformer, Graph Neural Networks (GNN), and Autoencoder.

[0003] Among them, compared with other deep learning algorithms, the advantage of the graph neural network method is that it is more suitable for processing time series data with graph structure characteristics, can effectively capture and utilize structural information, and thus more accurately detects anomalies; can process dynamic graph data and model the dynamic evolution process of time series data, better capturing time series anomalies; can learn rich node representations from local graph structures, capturing complex patterns and abnormal behaviors of nodes, thereby improving the accuracy of anomaly detection.

[0004] However, existing GNN methods mostly use methods to calculate similarity values between variables when learning existing relationships between variables, that is, graph relationship construction. The limitation of this method is that it cannot calculate similarity values for different data types. In general, time series data from sensors presents different data types, which can be divided into discrete and continuous attributes according to the value category. Common correlation measures include Pearson coefficient, cosine similarity, Euclidean distance, etc. There are limitations in measuring the correlation of different types of data, and the relationship between discrete and continuous values cannot be learned, so it still faces difficulties in modeling high-dimensional sensor data with many potential interrelationships. SUMMARY

[0005] In order to solve the problem that the existing time sequence anomaly detection method cannot learn the relationship between discrete values and continuous values, the application provides a multi-dimensional time sequence anomaly detection method based on standard Gini index graphing.

[0006] In order to achieve the above purpose, the application adopts the following technical solutions:

[0007] A multi-dimensional time sequence anomaly detection method based on standard Gini index graphing comprises the following steps:

[0008] Step 1: judging whether the value number of sensor data x is greater than a certain fixed value to determine whether to use a discretization module to discretize the sensor data; the specific operation is:

[0009] Judging whether the value number of sensor data x is greater than Num, when greater than Num, the sensor data x is a continuous value, using a discretization module to discretize it, that is, generating bins equal difference values between min(x) and max(x) through a binning function to divide x into bins-1 boxes, and the data in the same box is assigned the same value; otherwise, the sensor data x is unchanged, wherein Num is 10 and bins is 3.

[0010] Step 2: calculating the standard Gini index between two sensors to obtain the similarity value between the sensors, and merging the similarity values obtained by calculating between all sensors to obtain a relationship matrix S of the sensors; the specific operation is:

[0011] Using the data processed in step 1, the standard Gini index between two sensors is calculated according to formula (1) to obtain the similarity value SGini(A,Y) between the sensors:

[0012]

[0013] Wherein A and Y represent the data of two sensors; Indicates the sample number, r and k are the category numbers under A and Y, Indicates the edge and joint distribution probability of A and Y respectively; i indicates the i-th class under A, j indicates the j-th class under Y; i' indicates the i'-th class under A, and j' indicates the j'-th class under Y;

[0014]

[0015] Composed of the sum of the following four items:

[0016]

[0017]

[0018] Wherein

[0019] wherein

[0020] wherein

[0021] According to the above formula, the similarity values calculated between all sensors two by two are merged into a sensor relationship matrix S, as formula (2):

[0022]

[0023] Step 3: Utilize the embedding vector to flexibly capture the unique characteristics of each sensor; that is, v i ∈R d , wherein v i represents the embedding vector of sensor i, i represents the sensor, the value range of which is i∈{1, 2,..., Z}, Z is the number of sensors, and d represents the dimension of the embedding vector.

[0024] Step 4: According to the reconstruction error minimization and the graph attention-based feature extractor, output the reconstruction result of the original variable; the specific operation is as follows:

[0025] First, according to formula (3), the graph attention-based feature extractor and the sensor relationship matrix S learned in step 2 are used to fuse node information and neighbors, and then according to formula (5), the reconstruction error minimization outputs the model prediction data formula (4),

[0026]

[0027] wherein represents the feature vector of the i-th node after message aggregation at the t time point, is the input feature of sensor i; Z i ={j|S ji >0} is the neighbor set of sensor i obtained by the relationship matrix S; wherein the embedding vector v i of sensor i is connected with the corresponding transformation feature , a is a learned sparse vector of the attention mechanism, a T represents the transpose of a, represents series connection, LeakyReLU is a nonlinear activation function used to calculate attention sparsity, and the attention function is normalized using a softmax function; W is a trainable weight matrix;

[0028] After obtaining the representation of N nodes, it is dot multiplied with the embedding vector, and the output dimension of the stacked fully connected layer across all nodes is N, predicting the sensor value at time t, as formula (4):

[0029]

[0030] Where f θ represents the stacked fully connected layer function, represents the predicted data at time t, represents dot multiplication, using the mean square error of the predicted data and the observed data as the loss function L MSE , as formula (5):

[0031]

[0032] Where w is the window size, T train is the time size of the training set in the data set, S t represents the observed data at time t; the data set is the MSL data set, and the data set is divided into training set and test set, wherein the training set only has normal data, the training set data is divided into training set and validation set according to 6:4, and the test set is tested.

[0033] Step 5: the maximum error of the reconstruction result and the original result in the validation set is taken as a fixed threshold; the specific operation is:

[0034] The maximum error of the reconstruction result and the original result in the validation set is taken as a fixed threshold to obtain the abnormal detection result by using formula (6);

[0035]

[0036] Where A(t) represents the fixed threshold for detecting whether it is abnormal, i represents the a i value of the i th sensor, Err i (t) is the difference between the predicted value and the observed value of the sensor i, is the median and quartile value. It helps to improve the robustness of abnormal deviation normalization.

[0037] Step 6: the abnormal detection result is obtained by judging whether the error is greater than the fixed threshold. The specific operation is:

[0038] When the error of the test set reconstruction result and the original result is greater than the fixed threshold in step 5, it is an abnormal point, otherwise it is normal.

[0039] Compared with the prior art, the present application has the following advantages:

[0040] (1) The multi-dimensional time series anomaly detection method based on standard Gini index graphing can effectively alleviate the multi-value bias problem, thereby better depicting the similarity between different types of data to improve the results of anomaly detection.

[0041] (2) The multi-dimensional time series anomaly detection method based on standard Gini index graphing connects the sensor embedded vector and the corresponding transformation feature, which helps to better reconstruct the data. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 A flowchart of a multi-dimensional time series anomaly detection method based on standard Gini index graphing;

[0043] Figure 2 A framework diagram of a multi-dimensional time series anomaly detection method based on standard Gini index graphing;

[0044] Figure 3 An example graph of the adjacency relationship matrix obtained in step 2 of embodiment 1 of the present application;

[0045] Figures 4-15 An example graph of the original data and reconstructed data of a part of the sensor obtained in step 4 of the embodiment of the present application; wherein:

[0046] Figure 4 A graph of the observed data and reconstructed data of sensor M-1 on the validation set, (1) is the observation result of M-1 on the validation set, and (2) is the reconstructed result of M-1 on the validation set output by the feature extractor based on graph attention according to the reconstruction error minimization;

[0047] Figure 5 A graph of the observed data and reconstructed data of sensor T-4 on the validation set, (1) is the observation result of T-4 on the validation set, and (2) is the reconstructed result of T-4 on the validation set output by the feature extractor based on graph attention according to the reconstruction error minimization;

[0048] Figure 6 A graph of the observed data and reconstructed data of sensor T-5 on the validation set, (1) is the observation result of T-5 on the validation set, and (2) is the reconstructed result of T-5 on the validation set output by the feature extractor based on graph attention according to the reconstruction error minimization;

[0049] Figure 7 A graph of the observed data and reconstructed data of sensor M-3 on the validation set, (1) is the observation result of M-3 on the validation set, and (2) is the reconstructed result of M-3 on the validation set output by the feature extractor based on graph attention according to the reconstruction error minimization;

[0050] Figure 8Graph of observed data vs. reconstructed data for sensor M-4 on the validation set, (1) is the observed result for M-4 on the validation set, (2) is the reconstructed result for M-4 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0051] Figure 9 Graph of observed data vs. reconstructed data for sensor M-5 on the validation set, (1) is the observed result for M-5 on the validation set, (2) is the reconstructed result for M-5 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0052] Figure 10 Graph of observed data vs. reconstructed data for sensor C-1 on the validation set, (1) is the observed result for C-1 on the validation set, (2) is the reconstructed result for C-1 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0053] Figure 11 Graph of observed data vs. reconstructed data for sensor T-13 on the validation set, (1) is the observed result for T-13 on the validation set, (2) is the reconstructed result for T-13 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0054] Figure 12 Graph of observed data vs. reconstructed data for sensor F-5 on the validation set, (1) is the observed result for F-5 on the validation set, (2) is the reconstructed result for F-5 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0055] Figure 13 Graph of observed data vs. reconstructed data for sensor P-11 on the validation set, (1) is the observed result for P-11 on the validation set, (2) is the reconstructed result for P-11 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0056] Figure 14 Graph of observed data vs. reconstructed data for sensor D-16 on the validation set, (1) is the observed result for D-16 on the validation set, (2) is the reconstructed result for D-16 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0057] Figure 15 Graph of observed data vs. reconstructed data for sensor F-8 on the validation set, (1) is the observed result for F-8 on the validation set, (2) is the reconstructed result for F-8 on the validation set output by the feature extractor based on graph attention and reconstruction error minimization;

[0058] Figure 16An example graph of predicted labels and true labels obtained for step 6 of the embodiment of the present application; (1) is the predicted label of the test set according to the fixed threshold value, (2) is the true label of the test set. DETAILED DESCRIPTION

[0059] A multi-dimensional time series anomaly detection method based on standard Gini index composition, comprising the following steps:

[0060] Step 1: Determine whether the number of values of sensor data x is greater than a certain fixed value to determine whether to use a discretization module to discretize the sensor data; The specific operation is:

[0061] Determine whether the number of values of sensor data x is greater than Num, when greater than Num, the sensor data x is continuous value, use the discretization module to discretize it, that is, generate bins equal difference values between min(x) and max(x) through the binning function, divide x into bins-1 boxes, the data in the same box is assigned the same value; Otherwise, the sensor data x is unchanged, wherein Num takes the value of 10, and bins takes the value of 3.

[0062] Step 2: Calculate the standard Gini index between two sensors to obtain the similarity value between the sensors, and combine the similarity values obtained by calculating between all sensors to obtain the relationship matrix S of the sensors; The specific operation is:

[0063] The standard Gini index between two sensors is calculated according to formula (1) to obtain the similarity value SGini(A, Y) between the sensors:

[0064]

[0065] Wherein A, Y represent the data of two sensors; N represents the number of samples, r and k are the number of categories under A and Y respectively, respectively represent the marginal and joint distribution probability of A and Y; i represents the ith class under A, j represents the jth class under Y; i' represents the ith' class under A, and j' represents the jth' class under Y;

[0066]

[0067] Composed of the sum of the following four items:

[0068]

[0069]

[0070] Wherein

[0071] wherein wherein

[0072] According to the above formula, the similarity values calculated between all sensors two by two are merged into a sensor relationship matrix S, as formula (2):

[0073]

[0074] Step 3: Utilize the embedding vector to flexibly capture the unique features of each sensor; that is, v i ∈R d , wherein v i represents the embedding vector of sensor i, i represents the sensor, the value range of which is i∈{1, 2,..., Z}, Z is the number of sensors, and d represents the dimension of the embedding vector.

[0075] Step 4: According to the reconstruction error minimization and the graph attention-based feature extractor, output the reconstruction result of the original variable; the specific operation is as follows:

[0076] First, according to formula (3), the graph attention-based feature extractor and the sensor relationship matrix S learned in step 2 are used to fuse node information and neighbors, and then according to formula (5), the reconstruction error minimization outputs the model prediction data formula (4),

[0077]

[0078] wherein represents the feature vector of the i-th node after message aggregation at the t time point, is the input feature of sensor i; Z i ={j|S ji >0} is the neighbor set of sensor i obtained by the relationship matrix S; wherein the embedding vector v i of sensor i is connected with the corresponding transformation feature , a is a learned sparse vector of the attention mechanism, a T represents the transpose of a, represents series connection, LeakyReLU is a nonlinear activation function used to calculate attention sparsity, and the attention function is normalized using a softmax function; W is a trainable weight matrix;

[0079] After obtaining the representation of N nodes, it is dot multiplied with the embedding vector and outputs a dimension of N stacked fully connected layer input across all nodes, predicting sensor values at time t, as shown in equation (4):

[0080]

[0081] where f θ represents a stacked fully connected layer function, represents the predicted data at time t, represents dot multiplication, using the mean squared error of the predicted data and the observed data as the loss function L MSE as shown in equation (5):

[0082]

[0083] where w is the window size, T train is the time size of the training set in the data set, S t represents the observed data at time t; the data set is the MSL data set, and the data set is divided into a training set and a test set, wherein the training set only has normal data, and the training set data is divided into a training set and a validation set according to a ratio of 6:4, and the test set is tested.

[0084] Step 5: The maximum error of the reconstruction result and the original result in the validation set is taken as a fixed threshold; the specific operation is as follows:

[0085] The maximum error of the reconstruction result and the original result in the validation set is taken as a fixed threshold to obtain the abnormal detection result by using equation (6);

[0086]

[0087] where A(t) represents the fixed threshold for detecting whether it is abnormal, i represents the a i value of the i-th sensor, Err i (t) is the difference between the predicted value and the observed value of sensor i, is the median and quartile value. It helps to improve the robustness of abnormal deviation normalization.

[0088] Step 6: The abnormal detection result is obtained by judging whether the error is greater than the fixed threshold. The specific operation is as follows:

[0089] When the error of the test set reconstruction result and the original result is greater than the fixed threshold in step 5, it is an abnormal point, otherwise it is normal.

[0090] The present application carries out experiments on the MSL data set, which is divided into a training set and a test set, wherein the training set only contains normal data, the training set is divided into a training set and a validation set according to 6:4, and the test set is tested. The experiment is carried out for three experiments of epoch 10, 50 and 80, and is evaluated from the following five indexes: F-measure, precision, recall, false alarm and miss rate. When the indexes false alarm and miss rate are less than 0.2, it indicates that the effect of the model is better, from table 1, the value of miss rate is far less than 0.2, the value of false alarm is also less than 0.2, and with the increase of epoch, the values of the five indexes gradually become better, and a higher recall rate value is obtained, which is friendly to time series anomaly detection.

[0091] Table 1: Results of a multi-dimensional time series anomaly detection method based on standard Gini index graphing

[0092]

[0093] The contents not described in detail in the specification of the present application belong to the prior art known to those skilled in the art. Although the above describes the specific embodiments of the present application in a manner of illustration, so as to facilitate the understanding of the present application by those skilled in the art, it should be clear that the present application is not limited to the scope of the specific embodiments, and for those skilled in the art, it is obvious that various changes are within the spirit and scope of the present application defined and limited by the appended claims, and all the inventions utilizing the concept of the present application are within the scope of protection.

Claims

1. A multi-dimensional time series anomaly detection method based on standard Gini index composition, characterized by: The following steps are involved: Step 1: Determine whether the number of values ​​of the sensor data x is greater than a fixed value, and decide whether to use the discretization module to discretize the sensor data; Step 2: Calculate the standard Gini index between two sensors to obtain the similarity value between the sensors, and merge the similarity values ​​calculated between all two sensors into the sensor relationship matrix S; Step 3: Utilize the embedding vector to flexibly capture the unique characteristics of each sensor; Step 4: Output the reconstruction result of the original variable based on the feature extractor that minimizes the reconstruction error and is based on graph attention; Step 5: The maximum error between the reconstructed result and the original result in the validation set is used as a fixed threshold; Step 6: Obtain the anomaly detection result by judging whether the error is greater than a fixed threshold; The specific operation of step 4 is as follows: first, according to formula (3), the feature extractor based on graph attention and the sensor relationship matrix S learned in step 2 are used to fuse the node information and neighbors, and then according to formula (5), the error minimization output model prediction data formula (4) is reconstructed. in Represents the feature vector of the message aggregation of the i-th node at time point t, is the input feature of sensor i; Z i ={j|S ji >0} is the neighbor set of sensor i obtained by the relationship matrix S; in The embedding vector v of sensor i i and the corresponding transformation features Connected together, a is the learning sparse vector of the attention mechanism, a T represents the transpose of a, Represents concatenation, LeakyReLU is a nonlinear activation function used to calculate attention sparsity, and the softmax function is used to normalize the attention function; W is a trainable weight matrix; After obtaining the representation of N nodes, we multiply it by the embedding vector and output the result across all nodes as the input of the stacked fully connected layer with dimension N to predict the sensor value at time t, as shown in Equation (4): Among them, f θ represents the stacked fully connected layer function, represents the predicted data at time point t, Represents point product, using the mean square error of predicted data and observed data as the loss function L MSE , as shown in formula (5): Where w is the window size, T train is the time size of the training set in the dataset, S t Represents the observation data at time point t; the dataset is the MSL dataset, which is divided into a training set and a test set. The training set contains only normal data. The training set data is divided into a training set and a validation set at a ratio of 6:4, and tested on the test set.

2. The multidimensional time series anomaly detection method based on standard Gini index mapping according to claim 1 is characterized by: The specific operation of step 1 is as follows: determine whether the number of values ​​of the sensor data x is greater than Num. If it is greater than Num, the sensor data x is a continuous value, and the discretization module is used to discretize it, that is, the binning function is used to generate bins equal interval values ​​between min(x) and max(x), and x is divided into bins-1 bins. The data in the same bin are assigned the same value; otherwise, the sensor data x remains unchanged, where Num is 10 and bins is 3.

3. The multidimensional time series anomaly detection method based on standard Gini index mapping according to claim 2 is characterized by: The specific operation of step 2 is: using the data processed in step 1 to calculate the standard Gini index between the two sensors according to formula (1) to obtain the similarity value SGini(A, Y) between the sensors: Among them, A and Y represent the data of two sensors; N represents the number of samples, r and k are the number of categories under A and Y respectively. n ij Represent the marginal and joint distribution probabilities of A and Y respectively; i represents the i-th class under A, j represents the j-th class under Y; i' represents the i'th class under A, j' represents the j'th class under Y; The sum of the following four items composition: in in in According to the above formula, the similarity values ​​calculated between all sensors are merged into the sensor relationship matrix S, as shown in formula (2):

4. The multidimensional time series anomaly detection method based on standard Gini index mapping according to claim 3 is characterized by: The specific operation of step 3 is to flexibly capture the unique features of each sensor using the embedding vector, i.e., v i ∈R d , where v i represents the embedding vector of sensor i, i represents the sensor, and its value range is i∈{1,2,...,Z}, Z is the number of sensors, and d represents the dimension of the embedding vector.

5. The multi-dimensional time series anomaly detection method based on standard Gini index mapping according to claim 4 is characterized by: The specific operation of step 5 is: using formula (6) to take the maximum error between the reconstruction result of the validation set and the original result as a fixed threshold to obtain the result of anomaly detection; Among them, A(t) represents the fixed threshold to detect whether it is abnormal, i represents the a of the i-th sensor i (t) value, Err i (t) is the difference between the predicted value and the observed value of sensor i, are the median and quartile values.

6. The multi-dimensional time series anomaly detection method based on standard Gini index mapping according to claim 5 is characterized by: The specific operation of step 6 is: when the error between the reconstructed result of the test set and the original result is greater than the fixed threshold in step 5, it is an abnormal point, otherwise it is normal.

Images