A multi-scale joint optimization multivariate time sequence anomaly detection method and system

Abstract

The application discloses a kind of multivariate time series anomaly detection method and system of multiscale joint optimization, which comprises: obtaining multivariate time series data, and carrying out standardization processing;Based on multi-head attention and graph convolution operation, capture and splice the space-time dependence relationship of standard data set from different angles;Global-local context embedding module is based on the encoding and multilayer perception machine mapping of space-time fusion feature;Based on the calculation of abnormal score of prediction output and true value;Threshold is calculated based on abnormal score and epsilon method, and abnormal detection result is obtained based on the comparison result.The system includes data preprocessing module, feature capture module, output prediction module, anomaly calculation module and anomaly output module.By using the application, the space-time dependence relationship of multivariate time series can be modeled, and the robustness of the detection model to sudden anomalies and local fluctuations can be improved.The application can be widely applied in the field of data time series anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of data temporal anomaly detection technology, and in particular to a multi-scale joint optimization method and system for multivariate temporal anomaly detection. Background Technology

[0002] In many practical applications, data is often multi-dimensional and changes over time; this type of data is called multivariate time series. Anomaly detection is an important task in data analysis, aiming to identify patterns or behaviors that differ from the majority of data. Traditional univariate time series anomaly detection methods cannot fully utilize the correlations between variables in multivariate time series data, hence the emergence of multivariate time series anomaly detection. Multivariate time series anomaly detection has extremely wide applications in modern society: for example, in industrial production, it can be used to monitor equipment status in real time and detect potential faults early; in the field of cybersecurity, it can be used to detect abnormal network traffic and intrusion behavior; and in the financial sector, it can be used to detect transaction fraud and sudden economic anomalies in the market.

[0003] In recent years, deep learning technology has made significant progress in the field of multivariate time series anomaly detection. For example, Gated Recurrent Units (GRUs), Long Short-Term Memory (LSTMs), and attention mechanisms are used to capture the temporal dependencies of multivariate time series data. Graph Neural Networks (GNNs) are used to treat each variable as a separate node in a graph to obtain the spatial dependencies of multivariate time series. Currently, a common approach combines GNNs with a time encoder to capture both spatial and temporal dependencies of multivariate time series, followed by prediction and reconstruction methods, using prediction errors or reconstruction probabilities to identify anomalies. However, these methods model the temporal and spatial dimensions of multivariate time series separately, making it impossible to consider the correlations between different variables at different timestamps, thus failing to comprehensively model the spatiotemporal dependencies in multivariate time series data. Furthermore, they cannot fit the large number of anomalies and local fluctuations present in anomaly detection, reducing the robustness of the anomaly detection model and lowering the performance of multivariate time series anomaly detection. Summary of the Invention

[0004] To address the aforementioned technical problems, the present invention aims to provide a multi-scale joint optimization method and system for detecting multivariate time series anomalies, which can model the spatiotemporal dependencies of multivariate time series and improve the robustness of the detection model to sudden anomalies and local small fluctuations.

[0005] The first technical solution adopted in this invention is: a multi-scale joint optimization method for detecting multivariate temporal anomalies, comprising the following steps:

[0006] Obtain multivariate time series data and perform standardization processing to obtain a standard dataset;

[0007] Based on multi-head attention and graph convolution operations, spatiotemporal dependencies of standard datasets are captured from different perspectives, and spatiotemporal features are concatenated to obtain spatiotemporal fusion features.

[0008] The spatiotemporal fusion features are encoded using a global-local context embedding module and represented by a multilayer perceptron to obtain the prediction output.

[0009] Anomaly scores are calculated based on the predicted output and the true values ​​from the standard dataset.

[0010] The threshold is calculated based on the set of anomaly scores and the Epsilon method, and the anomaly detection result is obtained based on the comparison between the anomaly scores and the threshold.

[0011] Furthermore, the step of acquiring multivariate time series data and performing standardization processing to obtain a standard dataset specifically includes:

[0012] Collect multivariate time series data and process missing and duplicate values ​​to obtain a high-quality dataset;

[0013] Data normalization is performed on high-quality datasets to obtain normalized datasets;

[0014] The normalized dataset is cleaned using the spectral residual algorithm to obtain a standard dataset.

[0015] Furthermore, the step of capturing spatiotemporal dependencies in the standard dataset from different perspectives based on multi-head attention and graph convolution operations, and then concatenating the captured spatiotemporal features to obtain spatiotemporal fusion features, specifically includes:

[0016] The standard dataset was divided according to the time dimension to obtain several sequence segments;

[0017] The encoder performs linear mapping on several sequence segments to obtain output feature variables;

[0018] The similarity between output feature variables is measured based on the dot product operation, resulting in a graph with spatial dependencies;

[0019] The spatially dependent graph temporal distance is calculated based on the multi-head attention mechanism and the temporal distance factor, resulting in a spatiotemporally dependent graph.

[0020] Spatiotemporal dependency features are obtained by capturing spatiotemporal dependencies in graphs with spatiotemporal dependencies based on mobile pooling graph neural networks.

[0021] Temporal pooling is performed on the spatiotemporal dependency features to obtain high-dimensional spatiotemporal dependency features.

[0022] Based on several parallel layer structures, high-dimensional spatiotemporal dependency features are captured from different perspectives, and spatiotemporal fusion features are obtained by splicing the captured high-dimensional spatiotemporal dependency features.

[0023] This optimization step enables hybrid modeling of the time and space of time series, capturing the correlation between different variables in a multivariate time series at different timestamps. It ensures that variables with closer timestamps exhibit stronger correlations than those with more distant timestamps, facilitating a comprehensive analysis of the complex spatiotemporal relationships in the data.

[0024] Furthermore, the step of encoding the spatiotemporal fusion features based on the global-local context embedding module and using a multilayer perceptron to map the encoded representation to obtain the predicted output specifically includes:

[0025] Multi-scale contextual information is extracted from spatiotemporal fusion features based on dilated convolution and channel attention to obtain global features;

[0026] Local features are obtained by downsampling spatiotemporal fusion features based on one-dimensional convolutional layers;

[0027] Global and local features are input into a multilayer perceptron with residual connections to obtain the predicted output.

[0028] This optimization step enables the anomaly detection model to effectively fit sudden anomalies and local small fluctuations, thereby improving the robustness of the anomaly detection model.

[0029] Furthermore, the step of extracting multi-scale contextual information from spatiotemporal fusion features based on dilated convolution and channel attention to obtain global features specifically includes:

[0030] Multi-scale contextual information for spatiotemporal fusion features is extracted based on dilated convolution.

[0031] Multi-scale contextual information is embedded into the channels based on global equal pooling, and a weight value is assigned to each channel through channel attention;

[0032] The weight values ​​of the channels are obtained based on the fully connected layer, and the multi-scale contextual information between the channels is fused to obtain global features.

[0033] Furthermore, the abnormal score is calculated using the following expression:

[0034]

[0035] Among them, S t Let N represent the outlier score at time t, and N represent the total number of variables. This represents the true value of the i-th variable at time t. This represents the predicted value of the i-th variable at time t.

[0036] Furthermore, the threshold is calculated using the following expression:

[0037]

[0038] Δμ(S)=μ(S)-μ({S i ∈S|S i <∈})

[0039] Δσ(S)=σ(S)-σ({S i ∈S|S i <∈})

[0040] S a ={S i ∈S|S i >∈}

[0041] P seq =sequence of S a

[0042] Where ∈ represents the threshold, S represents the outlier score sequence, μ(S) represents the expected value of the outlier score sequence S, σ(S) represents the standard deviation of the outlier score sequence S, Δμ(S) represents the influence of the true outlier scores on the expected value of the outlier score sequence, and Δσ(S) represents the influence of the true outlier scores on the standard deviation of the outlier score sequence. i S represents the i-th data point in the abnormal score sequence. a Let P represent the set of true outlier scores. seg S represents a A sequence of continuous abnormalities.

[0043] The second technical solution adopted in this invention is: a multi-scale joint optimization multivariate temporal anomaly detection system, comprising:

[0044] The data preprocessing module acquires multivariate time series data and performs standardization processing to obtain a standard dataset;

[0045] The feature capture module captures the spatiotemporal dependencies of the standard dataset from different perspectives based on multi-head attention and graph convolution operations, and performs a concatenation operation on the captured spatiotemporal features to obtain spatiotemporal fusion features.

[0046] The output prediction module encodes the spatiotemporal fusion features based on the global-local context embedding module and uses a multilayer perceptron to map the encoded representation to obtain the prediction output.

[0047] The anomaly calculation module calculates anomaly scores based on the predicted output and the true values ​​in the standard dataset.

[0048] The anomaly output module calculates a threshold based on the set of anomaly scores and the Epsilon method, and obtains the anomaly detection result based on the comparison between the anomaly scores and the threshold.

[0049] The beneficial effects of the method and system of this invention are as follows: This invention generates a spatiotemporal correlation graph by using dot product operation and multi-head attention mechanism, and uses graph convolution operation to perform hybrid modeling of the spatiotemporal features of multivariate time series, capturing the correlation of different variables of multivariate time series at different timestamps; by using global-local context information embedding, the distribution of time series is analyzed from both global and local perspectives, enabling the anomaly detection model to effectively fit sudden anomalies and local small fluctuations, and enhancing the robustness of the detection model to sudden anomalies and local small fluctuations. Attached Figure Description

[0050] Figure 1 This is a flowchart of the steps of a multi-scale joint optimization multivariate temporal anomaly detection method of the present invention;

[0051] Figure 2 This is a structural block diagram of a multi-scale joint optimization multivariate temporal anomaly detection system according to the present invention;

[0052] Figure 3 This is a schematic diagram of the spatiotemporal feature extraction process of a multi-scale joint optimization multivariate temporal anomaly detection method according to the present invention;

[0053] Figure 4 This is a schematic diagram of the global-local context embedding module of a multi-scale joint optimization multivariate temporal anomaly detection method of the present invention. Detailed Implementation

[0054] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adapted according to the understanding of those skilled in the art.

[0055] Reference Figure 1 This invention provides a multi-scale joint optimization method for detecting multivariate temporal anomalies, which includes the following steps:

[0056] S1. Obtain multivariate time series data and perform standardization processing to obtain a standard dataset;

[0057] S1.1 Collect multivariate time series data and process missing and duplicate values ​​to obtain a high-quality dataset;

[0058] Specifically, the first step is to determine the sources for acquiring multivariate time series data, including reading data from sensors, querying databases, and manually downloading data files. After collecting the multivariate time series data, missing and duplicate values ​​are processed to ensure data quality and applicability.

[0059] S1.2. Perform data normalization on the high-quality dataset to obtain a normalized dataset;

[0060] Specifically, to improve the robustness of the model, the high-quality dataset is normalized using the maximum and minimum values ​​from the dataset to obtain normalized data, the calculation expression of which is as follows:

[0061]

[0062] in, The normalized value of the dataset is represented by min(X), the minimum value in the dataset is represented by max(X), the maximum value in the dataset is represented by x, and ε is a fixed value to prevent the denominator from being 0.

[0063] After data normalization, all data are classified into the range [0, 1], and the processed data is scaled to the specified space. Finally, the data is restored by inverse normalization when the detection is completed.

[0064] S1.3 Clean the normalized dataset using the spectral residual algorithm to obtain the standard dataset.

[0065] Specifically, spectral residuals (SR) are used to clean the data to improve its quality and usability. First, a Fourier transform is performed on the data to obtain its frequency domain representation. Then, the logarithm of the spectrum is calculated, and the local average is subtracted to obtain the spectral residual. Next, an inverse Fourier transform is performed on the spectral residual to restore the data to the time domain. The signal at this point contains outliers from the original data. Finally, the restored time-domain signal is analyzed to identify and process outliers. Data correction is performed through replacement to obtain a standard dataset. In a specific embodiment of this invention, the standard dataset is further divided into a training set and a test set, depending on their purpose.

[0066] S2. Based on multi-head attention and graph convolution operations, the spatiotemporal dependencies of the standard dataset are captured from different perspectives, and the captured spatiotemporal features are spliced ​​to obtain spatiotemporal fusion features.

[0067] S2.1. Divide the standard dataset according to the time dimension to obtain several sequence segments;

[0068] Specifically, refer to Figure 3 The standard multivariate time series dataset obtained in step S1 is represented in the following form:

[0069] X∈R N×L

[0070] Where N represents the total number of variables and L represents the timestamp length.

[0071] Standard multivariate time series data is divided into sequence segments of length f based on the time dimension, and its representation is as follows:

[0072]

[0073] Among them, X t X represents a sequence segment with timestamp length f. t ∈R N×f x t，i Let i represent the i-th variable feature of the t-th segment.

[0074] After partitioning, the number of sequence segments is expressed as:

[0075] S2.2. Based on the encoder, perform linear mapping processing on several sequence segments to obtain output feature variables;

[0076] Specifically, encoder f is used c (·|W c A linear mapping process is performed on several sequence segments. The expression of the mapping function is as follows:

[0077] x′ t，i =f c (x t，i |W c )

[0078] Among them, W c f represents the encoder weights. c Denotes the encoder mapping function, x′ t，i This indicates that the i-th variable feature of the t-th segment has been processed by f. c Output features after linear mapping.

[0079] In the process of linear data mapping, in order to preserve the relative positional information between different segments, positional encoding PE(t) is introduced to obtain the output feature variable, the expression of which is as follows:

[0080] z t，i =PE(t)+x′ t，i

[0081] Among them, z t，i Let PE(t) represent the i-th variable feature of the t-th segment after positional encoding, where PE(t) represents the positional encoding.

[0082] S2.3. Based on the dot product operation, the similarity between output feature variables is measured to obtain a graph with spatial dependence;

[0083] Specifically, when constructing a spatiotemporal graph, all variables within a timestamp segment are interconnected. If two variables exhibit high similarity, they are considered strongly correlated. The dot product operation is used to measure the similarity between variables, and its expression is as follows:

[0084] e tr，ij =h s (z t，i (h) s (z r，j )) T

[0085]

[0086] i, j∈[1, N]

[0087] h s (z)=zW s

[0088] Among them, e tr，ij h represents the correlation between the i-th variable feature in the t-th segment and the j-th variable feature in the r-th segment. s (z) is used to enhance expressive ability, W s Let z represent the learnable weights, and z represent the variable features in a specific segment. t，i Let z represent the i-th variable feature in the t-th segment. r，j Let represent the feature of the j-th variable in the r-th segment.

[0089] A graph with spatial dependencies is expressed as follows:

[0090] G = (Z, E)

[0091]

[0092]

[0093] Where G represents a spatially dependent graph, Z is a set of different segments and different variable features, and E represents the adjacency matrix of graph G, whose elements represent the correlations between all variables in all segments.

[0094] S2.4. Calculate the temporal distance of a spatially dependent graph based on the multi-head attention mechanism and the temporal distance factor to obtain a spatiotemporally dependent graph.

[0095] Specifically, spatially dependent graphs only consider the spatiotemporal dependencies within segments, neglecting the temporal distances between different variables in different segments. To address this, a multi-head attention mechanism and a temporal distance factor are introduced to calculate the temporal distances between different variables in segments. For each node in graph G, we first define the attention score for each head for the input feature Z, expressed as follows:

[0096]

[0097] Where Q = W Q Z represents the query matrix, K = W K Z represents the bond matrix, V = W V Z represents the value matrix, W Q W K W V It is a learnable weight matrix, where Z represents the input variable features, and d head This represents the scaling factor.

[0098] And a time distance factor φ(t, r) is introduced, the expression of which is as follows:

[0099] φ(t, r) = e -α|t-r|

[0100] Where α represents the hyperparameter that adjusts the effect of time distance, φ(t, r) represents the time distance factor, and t and r represent different segments.

[0101] The edge weights of graph nodes in graph G are changed by the time distance factor and the multi-head attention score, as expressed below:

[0102] e′ tr，ij =A ij .φ(t, r)

[0103] Among them, A tr，ij Let φ(t, r) represent the attention score between the i-th variable feature in the t-th segment and the j-th variable feature in the r-th segment, where φ(t, r) represents the temporal distance factor, and t and r represent different segments. tr，ij ′ represents the correlation between the i-th variable feature in the t-th segment and the j-th variable feature in the r-th segment after multi-head attention and time distance factor operations.

[0104] Update the graph node features to obtain a spatiotemporally dependent graph G. out If Z remains unchanged, its variable correlation E is updated as follows:

[0105] G out =(Z, E′)

[0106]

[0107] Among them G out This represents a graph with spatiotemporal dependencies, where E′ represents the spatiotemporal correlation between different variables in different segments, Z represents all variables in all segments, and e tr，ij ′ represents the correlation between the i-th variable feature in the t-th segment and the j-th variable feature in the r-th segment.

[0108] S2.5. Based on the mobile pooling graph neural network, the spatiotemporal dependencies of graphs with spatiotemporal dependencies are captured to obtain spatiotemporal dependency features;

[0109] Specifically, a moving pooling graph neural network is used to capture the spatiotemporal dependencies within moving windows in multivariate time series data through graph convolution operations. Within each window, information between nodes is propagated and updated via a message-passing neural network, thereby updating the spatiotemporal dependency features. For the center node of the w-th window in the l-th layer... Within the same window, M segments share a group of adjacent nodes, and the central node is correlated with its adjacent nodes. (Propagation characteristics) Update using the following formula:

[0110]

[0111] in, This represents the propagation feature of the i-th variable in the t-th segment of the ;-th graph convolution. Let N represent the set of all neighboring nodes of the central node, where N is the total number of variables. This represents the j-th variable feature of the r-th segment in the ;-th layer graph convolution. This represents the correlation between the i-th variable feature of the t-th segment and the j-th variable feature of the r-th segment in the t-th layer graph convolution.

[0112] The expression for updating the propagated variable characteristics using a nonlinear function is as follows:

[0113]

[0114] in, f represents the variable feature of the i-th variable in the t-th segment of the (+1)-th graph convolution layer. g It is a nonlinear function. This represents the propagation feature of the i-th variable in the t-th segment of the l-th graph convolution. These are learnable parameters.

[0115] S2.6 Perform temporal pooling on the spatiotemporal dependency features to obtain high-dimensional spatiotemporal dependency features;

[0116] Specifically, after capturing the spatiotemporal dependencies within the moving window, temporal pooling is used to extract high-level features. Within each time window, the propagated spatiotemporal dependency features are averaged to obtain the high-dimensional spatiotemporal dependency features for each time window. This is achieved by using the updated high-dimensional spatiotemporal dependency features of the i-th variable from M given segments. The expression is as follows:

[0117]

[0118] in, This represents the i-th variable feature in the w-th moving window of the (l+1)-th graph convolution, which is the variable feature obtained by temporal pooling in the current layer. express The set of all adjacent nodes, where M is the number of segments. This indicates that the variable features in the (l+1)th layer graph convolution are averaged.

[0119] S2.7. Based on several parallel layer structures, high-dimensional spatiotemporal dependency features are captured from different angles, and the captured high-dimensional spatiotemporal dependency features are spliced ​​together to obtain spatiotemporal fusion features.

[0120] Specifically, several parallel layer structures are used to capture the spatiotemporal dependencies in multivariate time series data from different angles in multiple parallel layers. By splicing the spatiotemporal features of all parallel layers, the spatiotemporal fusion features of multivariate time series are obtained.

[0121] S3. Encode the spatiotemporal fusion features based on the global-local context embedding module, and use the multilayer perceptron mapping encoding representation to obtain the prediction output;

[0122] Specifically, refer to Figure 4 The global-local context embedding module consists of two parts: a parallel convolutional stream for feature extraction and a multilayer perceptron for feature modeling. The parallel convolutional stream also consists of dilated convolutional modules (DC) and ordinary convolutional modules (CC).

[0123] S3.1. Multi-scale contextual information is extracted from spatiotemporal fusion features based on dilated convolution and channel attention to obtain global features;

[0124] Specifically, the dilated convolution module acquires global dependencies through dilated convolutions with different dilation rates and channel attention. Assume the output of the spatiotemporal fusion feature at time t is x. t This feature is fed into parallel dilated convolutions to extract multi-scale contextual information, as expressed below:

[0125] DC k (x t ) = cat[DConv i(x t ;r j )]

[0126] In this context, `cat[.]` represents adding elements one by one. R represents the i-th dilated convolutional layer in the dilated convolutional module. j DC represents the hole velocity corresponding to the j-th layer in the dilated convolutional layer. k (x t ) represents the output of the k-th dilated convolutional module.

[0127] After extracting multi-scale contextual information using multiple parallel dilated convolutions with different dilation rates, channel attention assigns different weights to different channels, and global features are modeled. The global feature SE... i (x t The expression for ) is as follows:

[0128]

[0129] x t ∈R C×S

[0130] Among them, SE i (x t ) represents the output of the attention module for the i-th channel, F scale F represents the activation feature operation in channel attention. ex F represents the channel fusion operation in channel attention. sq This represents the embedding of multi-scale contextual information. This represents the output of the dilated convolution module, where C and S represent the number of variable channels and sequence length of the input features, respectively.

[0131] The modeling process for global features includes an embedding process and a fusion process. The embedding process involves embedding multi-scale contextual information into the channels based on global average pooling. The embedding expression is as follows:

[0132]

[0133] Among them, F sq (x t ) represents the multi-scale context information embedding operation, S represents the length of the input sequence, and x represents the length of the input sequence. t (l) represents the sequence feature at index l of time point t.

[0134] The fusion process involves assigning weights to each channel through channel attention, obtaining the weights for each channel through two fully connected layers, and fusing multi-scale contextual information between channels to obtain global features. The expression for channel fusion is as follows:

[0135]

[0136] in, This represents the channel fusion operation in channel attention. denoted by , where σ and η represent the output of the multi-scale context information embedding, and W0 and W1 represent the weights of the two fully connected layers.

[0137] After channel fusion, the output features of channel attention are expressed as follows:

[0138]

[0139] in, This represents the activation feature operation in channel attention. This represents the output of channel fusion in channel attention.

[0140] S3.2. Based on one-dimensional convolutional layers, spatiotemporal fusion features are downsampled to obtain local features;

[0141] Specifically, a one-dimensional convolutional layer is used to downsample the data features, matching the outputs of the dilated convolutional module and the ordinary convolutional module. The ordinary convolutional module is used to capture local dependencies, extracting semantic features at different depths and information with local features. It consists of three stacked one-dimensional convolutions and ReLU operations. t When input into a regular convolution module, the operation formula is as follows:

[0142]

[0143] in, CC represents the i-th one-dimensional convolutional layer (i ranges from 0 to 3). j (x t ) represents x t The output after passing through the j-th ordinary convolutional module.

[0144] S3.3 Input the global and local features into a multilayer perceptron with residual connections to obtain the prediction output;

[0145] Specifically, the outputs of dilated convolutional modules and regular convolutional modules are fused into a multilayer perceptron with residual connections. Residual connections improve the model's representational power and alleviate the gradient vanishing problem during backpropagation; the final predicted output sequence X... out Generated through a multilayer perceptron.

[0146] S4. Calculate the anomaly score based on the predicted output and the true values ​​of the standard dataset;

[0147] Specifically, before calculating the anomaly score, the anomaly detection model needs to be trained and optimized using the training set in the standard dataset. The training and optimization mainly includes the anomaly detection model content in steps S2 and S3 of this invention. The training and optimization method is to calculate the loss function of the anomaly detection model using the predicted output of the training set in the standard dataset obtained in step S3 and the true values ​​of the training set in the standard dataset. Its expression is as follows:

[0148]

[0149] in, This represents the true value of the i-th variable at time t. This represents the predicted value of the i-th variable at time t.

[0150] The anomaly detection model is trained and optimized by minimizing the loss function, resulting in the trained anomaly detection model.

[0151] In a specific implementation of this invention, the test set is input into the trained anomaly detection model to obtain the predicted output of the test set. Then, the anomaly score is calculated using the predicted output of the test set and the true value of the test set, thus avoiding calculation errors caused by the model not being fully trained.

[0152] The abnormal score is calculated using the following expression:

[0153]

[0154] Among them, S t Let N represent the outlier score at time t, and N represent the total number of variables. This represents the true value of the i-th variable at time t. This represents the predicted value of the i-th variable at time t.

[0155] S5. Calculate the threshold based on the set of anomaly scores and the Epsilon method, and obtain the anomaly detection result based on the comparison between the anomaly scores and the threshold.

[0156] Specifically, according to step S4, for a multivariate time series with W observations, the anomaly score sequence S = {S1, S2, ..., S...} w The threshold is calculated and updated based on the anomaly score sequence using the Epsilon method, and its expression is as follows:

[0157]

[0158] Δμ(S)=μ(S)-μ({S i ∈S|S i <∈})

[0159] Δσ(S)=σ(S)-σ({Si ∈S|S i <∈})

[0160] S a ={S i ∈S|S i >∈}

[0161] P seq =sequence of S a

[0162] Where ∈ represents the threshold, S represents the outlier score sequence, μ(S) represents the expected value of the outlier score sequence S, σ(S) represents the standard deviation of the outlier score sequence S, Δμ(S) represents the influence of the true outlier scores on the expected value of the outlier score sequence, and Δσ(S) represents the influence of the true outlier scores on the standard deviation of the outlier score sequence. i S represents the i-th data point in the abnormal score sequence. a Let P represent the set of true outlier scores. seg S represents a A sequence of continuous abnormalities.

[0163] Finally, the threshold and the abnormal score are compared. If the abnormal score is greater than the threshold, then the time is abnormal; otherwise, it is normal.

[0164] Reference Figure 2 This invention provides a multi-scale joint optimization multivariate temporal anomaly detection system, comprising:

[0165] The data preprocessing module acquires multivariate time series data and performs standardization processing to obtain a standard dataset;

[0166] The feature capture module captures the spatiotemporal dependencies of the standard dataset from different perspectives based on multi-head attention and graph convolution operations, and performs a concatenation operation on the captured spatiotemporal features to obtain spatiotemporal fusion features.

[0167] The output prediction module encodes the spatiotemporal fusion features based on the global-local context embedding module and uses a multilayer perceptron to map the encoded representation to obtain the prediction output.

[0168] The anomaly calculation module calculates anomaly scores based on the predicted output and the true values ​​in the standard dataset.

[0169] The anomaly output module calculates a threshold based on the set of anomaly scores and the Epsilon method, and obtains the anomaly detection result based on the comparison between the anomaly scores and the threshold.

[0170] The content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0171] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A multi-scale joint optimization method for multivariate temporal anomaly detection, characterized in that, Includes the following steps: Obtain multivariate time series data and perform standardization processing to obtain a standard dataset; Based on multi-head attention and graph convolution operations, spatiotemporal dependencies of standard datasets are captured from different perspectives, and spatiotemporal features are concatenated to obtain spatiotemporal fusion features. The spatiotemporal fusion features are encoded using a global-local context embedding module and represented by a multilayer perceptron to obtain the prediction output. Anomaly scores are calculated based on the predicted output and the true values ​​from the standard dataset. The threshold is calculated based on the set of anomaly scores and the Epsilon method, and the anomaly detection result is obtained based on the comparison between the anomaly scores and the threshold. The step of capturing spatiotemporal dependencies in the standard dataset from different perspectives based on multi-head attention and graph convolution operations, and then concatenating the captured spatiotemporal features to obtain spatiotemporal fusion features, specifically includes: The standard dataset was divided according to the time dimension to obtain several sequence segments; The encoder performs linear mapping on several sequence segments to obtain output feature variables; The similarity between output feature variables is measured based on the dot product operation, resulting in a graph with spatial dependencies; The spatially dependent graph temporal distance is calculated based on the multi-head attention mechanism and the temporal distance factor, resulting in a spatiotemporally dependent graph. Spatiotemporal dependency features are obtained by capturing spatiotemporal dependencies in graphs with spatiotemporal dependencies based on mobile pooling graph neural networks. Temporal pooling is performed on the spatiotemporal dependency features to obtain high-dimensional spatiotemporal dependency features. Based on several parallel layer structures, high-dimensional spatiotemporal dependency features are captured from different perspectives, and spatiotemporal fusion features are obtained by splicing the captured high-dimensional spatiotemporal dependency features.

2. The multi-scale joint optimization multivariate temporal anomaly detection method according to claim 1, characterized in that, The step of acquiring multivariate time series data and performing standardization to obtain a standard dataset specifically includes: Collect multivariate time series data and process missing and duplicate values ​​to obtain a high-quality dataset; Data normalization is performed on high-quality datasets to obtain normalized datasets; The normalized dataset is cleaned using the spectral residual algorithm to obtain a standard dataset.

3. The multi-scale joint optimization multivariate temporal anomaly detection method according to claim 1, characterized in that, The step of encoding the spatiotemporal fusion features based on the global-local context embedding module and using a multilayer perceptron to map and encode the representation to obtain the predicted output specifically includes: Multi-scale contextual information is extracted from spatiotemporal fusion features based on dilated convolution and channel attention to obtain global features; Local features are obtained by downsampling spatiotemporal fusion features based on one-dimensional convolutional layers; Global and local features are input into a multilayer perceptron with residual connections to obtain the predicted output.

4. The multi-scale joint optimization multivariate temporal anomaly detection method according to claim 3, characterized in that, The step of extracting multi-scale contextual information from spatiotemporal fusion features based on dilated convolution and channel attention to obtain global features specifically includes: Multi-scale contextual information for spatiotemporal fusion features is extracted based on dilated convolution. Multi-scale contextual information is embedded into the channels based on global equal pooling, and a weight value is assigned to each channel through channel attention; The weight values ​​of the channels are obtained based on the fully connected layer, and the multi-scale contextual information between the channels is fused to obtain global features.

5. The multi-scale joint optimization multivariate temporal anomaly detection method according to claim 1, characterized in that, The abnormal score is calculated using the following expression: in, Indicates the first The outlier score at each moment, Indicates the total number of variables. Indicates the first At the [time]th moment The true value of each variable Indicates the first At the [time]th moment Predicted values ​​for each variable.

6. The multi-scale joint optimization multivariate temporal anomaly detection method according to claim 1, characterized in that, The threshold is calculated using the following expression: in, Indicates the threshold. Represents an abnormal score sequence. Represents the sequence of abnormal scores Expected value Represents the sequence of abnormal scores standard deviation This represents the impact of the actual outlier scores on the expected value of the outlier score sequence. This indicates the impact of the true outlier scores on the standard deviation of the outlier score series. Indicates the first abnormal score in the sequence. Data points, This represents the set of true outlier scores. express A sequence of continuous anomalies.

7. A multi-scale joint optimization multivariate temporal anomaly detection system, characterized in that, A method for performing multivariate temporal anomaly detection using multi-scale joint optimization as described in claim 1 includes: The data preprocessing module acquires multivariate time series data and performs standardization processing to obtain a standard dataset; The feature capture module captures the spatiotemporal dependencies of the standard dataset from different perspectives based on multi-head attention and graph convolution operations, and performs a concatenation operation on the captured spatiotemporal features to obtain spatiotemporal fusion features. The output prediction module encodes the spatiotemporal fusion features based on the global-local context embedding module and uses a multilayer perceptron to map the encoded representation to obtain the prediction output. The anomaly calculation module calculates anomaly scores based on the predicted output and the true values ​​in the standard dataset. The anomaly output module calculates a threshold based on the set of anomaly scores and the Epsilon method, and obtains the anomaly detection result based on the comparison between the anomaly scores and the threshold.

Images