Abnormal detection system and method based on time series data and storage medium

Abstract

The invention provides an anomaly detection system and method based on time series data and a storage medium, and the system comprises a collection module which is used for collecting the time series data of equipment; the receiving module is used for receiving the time sequence data; the time sequence period extraction module is used for extracting periodic characteristics in the time sequence data; the anomaly detection module is used for matching different periodic features in the time series data with corresponding anomaly detection functions, and detecting the time series data to obtain a plurality of anomaly detection results; according to the method, the time series data are collected on the equipment, the Fourier transform is performed on the time series data to extract the periodic characteristics, the different periodic characteristics in the time series data are matched with the corresponding anomaly detection functions in the system, the time series data are detected, and a plurality of anomaly detection results are obtained. Therefore, abnormal conditions can be identified and detected more accurately, and the technical problem that a detection method in the prior art has significant limitation is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of time series data anomaly detection, and in particular to a time series data anomaly detection system, method and storage medium. Background Art

[0002] Time series anomaly detection is an important application and research focus in the fields of data analysis, signal processing, machine learning, and statistics, and is one of the core topics of data science and artificial intelligence. This field covers multiple research directions, one of the mainstream issues of which is anomaly detection in time series data. Given that time series data can be converted into high-dimensional data sequences, researchers can use a variety of data analysis techniques to conduct in-depth analysis, extract effective feature information, and identify anomalies or abnormal behaviors to reveal the potential laws and meanings in time series data, thereby achieving the goal of anomaly detection. Therefore, anomaly detection technology based on a variety of detection objective functions is one of the key methods to achieve high-precision anomaly detection.

[0003] In the analysis of time series data, these data can be regarded as a collection of multiple sensor data at multiple time points. Therefore, by considering the relationship between sensors, a more in-depth analysis of time series data can be performed. Current anomaly detection techniques can effectively identify anomalies in time series data. However, most of the current anomaly detection techniques mainly rely on the objective function of a single sensor, which means that they can only detect specific types of anomalies. In fact, there are many forms of expression for the detection objective function, and these different forms of expression will have different effects on the detection results. A single objective function is only one of the special cases, and this special case does not necessarily correspond to the optimal anomaly detection result. Therefore, the detection methods of the prior art have significant limitations. Summary of the invention

[0004] The present invention aims to at least solve the technical problem that the detection methods in the prior art have significant limitations, and in particular innovatively proposes a time series data-based anomaly detection system, method and storage medium.

[0005] In order to achieve the above-mentioned object of the present invention, the present invention provides a system for detecting anomalies based on time series data, the system comprising:

[0006] The acquisition module is used to collect the timing data of the device;

[0007] A receiving module, connected to the acquisition module, and configured to receive the time series data;

[0008] A time series period extraction module, connected to the receiving module, for extracting periodic features from the time series data;

[0009] An anomaly detection module, connected to the time series period extraction module, is used to use the different periodic features in the time series data to match the corresponding anomaly detection function, detect the time series data, obtain a number of anomaly detection results, merge the several anomaly detection results, and generate an anomaly detection report;

[0010] A storage module is connected to the receiving module and the anomaly detection module, and is used to store the time series data and the anomaly detection report.

[0011] As an optional embodiment of the present invention, optionally, the expression for extracting the periodic feature in the time series data by the time series period extraction module is:

[0012]

[0013] Among them, X(·) represents time series data, k represents the frequency index size, t represents the sensor number, N represents the Nth column of the time series data, x(·) represents the time series, and e represents the natural base.

[0014] As an optional embodiment of the present invention, optionally, the abnormality detection module includes:

[0015] A parameter initialization unit, used for initializing parameters of the system;

[0016] An extraction unit, connected to the parameter initialization unit, the storage module and the time series period extraction module, is used to obtain latent features of different dimensions in the time series data using different periodic features, wherein the latent features include a neighbor time series latent feature matrix and a periodic time series data latent feature matrix, and obtain a plurality of anomaly detection results using the latent features, fuse the plurality of anomaly detection results, and generate an anomaly detection report;

[0017] A result output unit is connected to the extraction unit and the storage module, and is used to obtain a detection result corresponding to the maximum anomaly score in the anomaly detection report, and use the detection result as a final anomaly detection result.

[0018] As an optional embodiment of the present invention, optionally, the step of the extraction unit acquiring the abnormality detection result includes:

[0019] A1. Constructing a loss function using the different periodic features and the anomaly detection function;

[0020] A2. Determine whether the iterative control variable in the parameter has reached the upper limit;

[0021] If so, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0022] If not, determine whether the loss function converges on the sensor feature vector and weight matrix;

[0023] A3. If yes, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0024] If not, the loss function is optimized using a gradient descent algorithm, and steps A2 to A3 are repeated.

[0025] As an optional embodiment of the present invention, optionally, the expression of the loss function is:

[0026]

[0027] in, represents the sensor i vector after splicing, v i represents the sensor feature vector, represents the concatenation operation, W represents the weight matrix, represents the time series, π(,) represents the attention coefficient, i represents sensor i, j represents sensor j, LeakyReLU(·) represents the activation function, a ⊥ (·) represents the learning coefficient vector of the attention mechanism, represents the vector of sensor j after stitching, a i,j represents the attention coefficient of sensor i to sensor j, represents the neighbors of sensor i, ∪ represents the union, exp(·) represents the exponential function, z′ i represents the graph convolution result of sensor i, represents element-wise multiplication, represents the representation of sensor i, π(i,k) represents the attention coefficient between sensor i and sensor k, o i,f represents the one-dimensional convolution result extracted according to the period f, Conv1D(·) represents the one-dimensional convolution, o i represents the one-dimensional convolution result, represents the weight corresponding to the period f, represents the sensor prediction value vector at time step t, f θ {·} indicates stacked fully connected layers, o N represents the one-dimensional convolution result of sensor N, z′ N represents the graph convolution result of sensor N, L MSE represents the minimum loss value, T train represents the length of training data, w represents the sliding window size, s trepresents the true sensor value vector at time step t, and ||·||2 represents the binary norm.

[0028] As an optional embodiment of the present invention, optionally, in step A3, optimizing the loss function by using a gradient descent algorithm includes:

[0029]

[0030] in, represents the gradient of the loss function to V during iteration, V represents the sensor feature vector, represents the partial derivative, L represents the loss value, represents the gradient of the loss function to W during iteration, W represents the weight matrix, V t+1 represents the sensor feature vector at the t+1th iteration, V t represents the sensor feature vector at the tth iteration, δ represents the learning rate, W t+1 represents the weight matrix at the t+1th iteration, W t represents the weight matrix at the tth iteration.

[0031] As an optional embodiment of the present invention, optionally, in step A2, the expression for calculating the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix is:

[0032]

[0033] Among them, Err i (·) represents the anomaly score of sensor i, t represents the time step, |·| represents the modulus, represents the true value of sensor i at time step t, represents the predicted value of sensor i at time step t, a i (t) represents the normalized anomaly score of sensor i, represents the mean, represents the standard deviation, A(·) represents the final anomaly score, Represents the maximum value among the i anomaly scores.

[0034] On the other hand, the present invention also provides a method for detecting anomalies based on time series data, which includes the system for detecting anomalies based on time series data.

[0035] As another optional embodiment of the present invention, optionally, the method further includes:

[0036] S1, collect time series data;

[0037] S2. Extracting periodic features from the time series data using Fourier transform;

[0038] S3, initializing parameters of the detection system;

[0039] S4. Constructing a loss function using the different periodic features and anomaly detection functions in the time series data;

[0040] S5, judging whether the iterative control variable in the parameter has reached the upper limit;

[0041] If so, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0042] If not, determine whether the loss function converges on the sensor feature vector and weight matrix;

[0043] S6. If yes, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0044] If not, the loss function is optimized using a gradient descent algorithm, and steps S5 to S6 are repeated;

[0045] S7: Fusing the detection results to generate an abnormality detection report.

[0046] The beneficial effect of the present invention is that the present invention collects time series data on the device, performs Fourier transform on the time series data to extract periodic features, and uses different periodic features in the time series data to match the corresponding anomaly detection function in the system, detects the time series data, and obtains a number of anomaly detection results, so that abnormal situations can be more accurately identified and detected, and the technical problem that the detection method in the prior art has significant limitations is solved. The present invention also optimizes the system by constructing a loss function and using a gradient descent algorithm, so that the system of the present invention can effectively adapt to the anomaly detection needs under different devices and scenarios. In addition, the present invention can further improve the accuracy and robustness of detection by calculating the hidden feature matrix of neighbor time series and the hidden feature matrix of periodic time series data.

[0047] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0049] Figure 1 It is a schematic diagram of the system structure of Example 1 of the present invention.

[0050] Figure 2 It is a flow chart of embodiment 1 of the present invention.

[0051] Figure 3 This is a flow chart of Embodiment 2 of the present invention.

[0052] Figure 4 It is a statistical chart comparing the accuracy of time series data anomaly detection performed by Example 1 of the present invention with the accuracy of the prior art. DETAILED DESCRIPTION

[0053] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0054] Example 1

[0055] A time series data anomaly detection system, the system comprising:

[0056] The acquisition module is used to collect the time series data of the device; in this embodiment, the acquisition module is a high-precision sensor array that can monitor the operation status of the device in real time and collect high-precision time series data. The sensor array is connected to the interface of the device to ensure the real-time and accuracy of data acquisition.

[0057] The receiving module is connected to the acquisition module and is used to receive the timing data. In the present embodiment, the receiving module is a wireless communication module, which is installed on the detection system and is connected to the acquisition module by wireless communication, so as to receive the timing data acquired by the acquisition module in real time.

[0058] A time series period extraction module, connected to the receiving module, for extracting periodic features from the time series data;

[0059] In this embodiment, the time series period extraction module converts the time domain data into frequency domain data by using Fourier transform, and then uses the frequency domain data to extract the periodic features in the time series data. Through Fourier transform, the periodic pattern in the time domain data can be effectively identified, thereby providing strong feature support for subsequent anomaly detection.

[0060] An anomaly detection module, connected to the time series period extraction module, is used to use the different periodic features in the time series data to match the corresponding anomaly detection function, detect the time series data, obtain a number of anomaly detection results, merge the several anomaly detection results, and generate an anomaly detection report;

[0061] The anomaly detection module includes an anomaly detection function library, which contains a variety of anomaly detection functions for matching different periodic features. In this embodiment, the anomaly detection module analyzes the periodic features provided by the time series period extraction module and selects a suitable anomaly detection function to match the periodic features by adaptive fusion. After the match is successful, the anomaly detection module will detect the time series data and identify potential abnormalities. The detection results will be fused and an anomaly detection report will be generated to facilitate further analysis and processing by the user or system administrator. The anomaly detection module also includes a parameter initialization unit, an extraction unit and a result output unit; the parameter initialization unit is used to initialize the relevant parameters involved in the process of anomaly detection of time series data; the extraction unit is used for the time series data stored in the time series data storage unit and different anomaly detection functions, combined with the extraction parameters initialized by the parameter initialization unit, to extract the hidden features of the time series data under different anomaly detection functions; the result output unit fuses the detection results of different detection target functions and stores them in the result storage unit in the storage module.

[0062] The storage module is connected to the receiving module and the anomaly detection module, and is used to store the time series data and the anomaly detection report. The storage module is a high-performance solid-state hard disk with the characteristics of fast reading and writing and large-capacity storage. In this embodiment, the storage module is not only responsible for storing the time series data transmitted by the acquisition module and the receiving module, but also responsible for saving the anomaly detection report generated by the anomaly detection module. In addition, the storage module also has a data backup function to ensure that in the event of equipment failure or data damage, data can be quickly restored to ensure the stable operation of the system.

[0063] like Figure 1 As shown, when in use, the system first monitors the operating status of the equipment in real time through the acquisition module and collects high-precision time series data. The collected data is transmitted to the receiving module through the wireless communication module to ensure the real-time and accuracy of the data. The receiving module passes the data to the time series period extraction module, which converts the time domain data into frequency domain data through Fourier transform, thereby extracting the periodic features in the time series data. Next, the anomaly detection module uses the extracted periodic features to match the functions in the anomaly detection function library. The anomaly detection function library contains a variety of anomaly detection functions that can detect different periodic features. The time series data is detected for outliers using different periodic features and anomaly detection functions to obtain multiple detection results. The result output unit fuses the detection results of different detection target functions to generate an anomaly detection report and stores it in the result storage unit in the storage module. The storage module is not only responsible for storing time series data and anomaly detection reports, but also has data backup functions to ensure data security and system stability. After the anomaly detection report is generated, the system administrator or user can analyze and process the report to promptly discover and handle potential abnormal situations.

[0064] To summarize, this embodiment collects time series data on the device, performs Fourier transform on the time series data to extract periodic features, and uses different periodic features in the time series data to match the corresponding anomaly detection functions in the system to detect the time series data and obtain a number of anomaly detection results, thereby being able to more accurately identify and detect abnormal situations and solve the technical problem that the detection methods in the prior art have significant limitations.

[0065] As an optional embodiment of the present invention, optionally, the expression for extracting the periodic feature in the time series data by the time series period extraction module is:

[0066]

[0067] Where X(·) represents time series data;

[0068] k represents the frequency index size;

[0069] t represents the sensor serial number;

[0070] N represents the Nth column of the time series data;

[0071] x(·) represents the time series

[0072] e represents the natural base;

[0073] A(k) represents the amplitude of frequency index k;

[0074] X(k) represents the time series data at frequency k;

[0075] Re(·) represents the real part of X(k);

[0076] Im(·) represents the imaginary part of X(k).

[0077] The first formula above is the Fourier transform formula, which is used to convert time domain data into frequency domain data. The time domain data x(t) = {x0, x1, x2, ..., x N-1}; The second formula is used to calculate the amplitude of each X(k), and then average the amplitude of each sensor at the same frequency. After obtaining the common amplitude, the top-k frequencies with the largest amplitudes are selected, and the corresponding weights are calculated based on the amplitudes. The frequency corresponding to the amplitude is a periodic feature.

[0078] The expression for calculating the corresponding weight using the amplitude is:

[0079]

[0080] in, Indicates A kThe corresponding weights;

[0081] A k represents the magnitude of frequency index k;

[0082] Softmax(·) represents the activation function.

[0083] As an optional embodiment of the present invention, optionally, the abnormality detection module includes:

[0084] A parameter initialization unit, used for initializing parameters of the system;

[0085] The parameters for parameter initialization include: dynamic window size w, sensor feature vector V, weight matrix W, adjacency matrix A, attention coefficient matrix E, learning coefficient vector a of attention mechanism, maximum number of neighbor nodes K, one-dimensional convolution kernel size c, graph convolution feature dimension f1, one-dimensional convolution feature dimension f2, iterative control variable P, maximum number of matrix iterations M, learning rate δ, and iterative convergence termination threshold τ.

[0086] Among them: the initial values ​​of the graph convolution feature dimension f1 and the one-dimensional convolution feature dimension f2 are positive integers, such as 64 or 8; the size of the adjacency matrix A is a matrix with N rows and columns, in which each element parameter is initialized to 1; the size of the weight matrix W is a matrix with f1 rows and w columns, in which each element parameter is initialized to a random number in the open interval (0,1). The size of the attention coefficient matrix E is a matrix with N rows and columns, in which each element parameter is initialized to 0. The iteration control variable P is a variable that controls the iteration process. The extraction iteration control variable P is initialized to 0; the upper limit of the extraction iteration control variable P is a variable that controls the upper limit of the number of iterations during the extraction iteration process, and the parameter is initialized to a positive integer, such as 1000; the learning rate δ is the parameter of the step size of iterating V and W during the iteration process, and the convergence termination threshold τ is the threshold parameter for judging whether the extraction iteration process has converged, and the parameter is initialized to a very small positive number, such as 0.002;

[0087] An extraction unit, connected to the parameter initialization unit, the storage module and the time series period extraction module, is used to obtain latent features of different dimensions in the time series data using different periodic features, wherein the latent features include a neighbor time series latent feature matrix and a periodic time series data latent feature matrix, and obtain a plurality of anomaly detection results using the latent features, fuse the plurality of anomaly detection results, and generate an anomaly detection report;

[0088] The extraction unit calculates the latent features of different dimensions of the time series data based on the time series data stored in the time series data storage unit in the storage module and the parameters initialized by the parameter initialization unit, combined with the time series period extraction model. The latent features of the time series data are extracted, including the neighbor time series latent feature matrix and the periodic time series data latent feature matrix; finally, the target loss function is constructed based on the distance function.

[0089] A result output unit is connected to the extraction unit and the storage module, and is used to obtain a detection result corresponding to the maximum anomaly score in the anomaly detection report, and use the detection result as a final anomaly detection result.

[0090] The result output unit is used to extract the most accurate sensor feature vector, weight matrix, adjacency matrix and anomaly score output, and store them in the result storage unit in the time series data module. The maximum anomaly score refers to the highest anomaly score of all sensors at the same time. The most accurate sensor feature vector V is the V with the highest anomaly detection accuracy. Since V is a randomly generated vector at the beginning, in the subsequent iteration process, sensors V with similar behaviors will become closer and closer, so that the relationship between different sensors can be discovered. Therefore, the system will more accurately identify abnormal data in the time series data based on these gradually optimized sensor feature vectors V. The iterative update of the weight matrix W is also based on the improvement of the model's anomaly detection performance in each iteration, ensuring that the model can dynamically adjust the weights of different sensor data in anomaly judgment, thereby improving the overall detection accuracy.

[0091] For the initialization of the adjacency matrix A, although each element is set to 1 at the beginning, as the iterations proceed, the model will learn the actual correlation between sensors and adjust the value of the adjacency matrix A accordingly. This means that the original assumption that all sensors are equally weighted will be replaced by a more sophisticated, data-driven relationship between sensors during the learning process, further enhancing the interpretability and accuracy of the model.

[0092] The initialization value of the attention coefficient matrix is ​​0, which means that in the initial iteration, the model pays equal attention to all sensor and time series features. However, as training progresses, the model dynamically adjusts the values ​​in the attention coefficient matrix according to the importance of different sensor feature vectors and time series data. This allows the model to pay more attention to features that contribute more to anomaly detection, thereby improving the sensitivity and accuracy of detection.

[0093] As an optional embodiment of the present invention, optionally, the step of the extraction unit acquiring the abnormality detection result includes:

[0094] A1. Constructing a loss function using the different periodic features and the anomaly detection function;

[0095] like Figure 2 As shown, it should be noted that the purpose of constructing the loss function in step A1 is to quantify the difference between the actual detection results and the expected targets, thereby guiding the optimization process of the system parameters. Specifically, the design of the loss function should be able to reflect the difference between abnormal data and normal data in the time series data, so that the system can accurately identify and distinguish the two types of data. In step A1, this embodiment first constructs a loss function that can evaluate the degree of abnormality based on the extracted periodic features (such as the frequency components and their weights obtained by Fourier transform) and the preset abnormality detection function.

[0096] A2. Determine whether the iterative control variable in the parameter has reached the upper limit. In this embodiment, when determining whether the iterative control variable has reached the upper limit, 1 is added to the extracted iterative control variable, and then it is determined whether the extracted iterative control variable is greater than the extraction iteration upper limit.

[0097] If so, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0098] If not, determine whether the loss function converges on the sensor feature vector and weight matrix;

[0099] In this embodiment, the basis for the system to determine whether the loss function converges on the sensor feature vector and the weight matrix is ​​whether the absolute value of the difference between the loss value before the start of this round of iteration and the loss value before the start of the previous round of iteration is less than the convergence judgment threshold; if it is less than, it is determined to have converged, otherwise, it is determined to have not converged.

[0100] A3. If yes, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0101] If not, the loss function is optimized using a gradient descent algorithm, and steps A2 to A3 are repeated.

[0102] As an optional embodiment of the present invention, optionally, the expression of the loss function is:

[0103]

[0104]

[0105] The above four formulas are expressions of convolution anomaly detection functions

[0106]

[0107] The above formula is a one-dimensional anomaly detection function. The periodic characteristics of the above calculations and the calculated weights are used in the one-dimensional convolution. One-dimensional convolution is to convolve data of different phases in the same cycle, using multiple cycles to obtain multiple convolution results, and then according to the weight Perform adaptive fusion.

[0108]

[0109] The above formula is the expression of the loss function, in which the neighbor time series latent feature matrix and the periodic time series data latent feature matrix are concatenated to approximate it; the distance function of the corresponding approximation value is established as the optimization target; regularization is used to constrain the optimization process of the loss function.

[0110] in, Represents the sensor i vector after splicing;

[0111] v i represents the sensor feature vector;

[0112] Represents a splicing operation;

[0113] W represents the weight matrix;

[0114] represents a time series;

[0115] π(,) represents the attention coefficient;

[0116] i represents sensor i;

[0117] j represents sensor j;

[0118] LeakyReLU(·) represents the activation function;

[0119] a ⊥ (·) represents the learning coefficient vector of the attention mechanism;

[0120] represents the vector of sensor j after stitching;

[0121] a i,j represents the attention coefficient of sensor i to sensor j;

[0122] represents the neighbors of sensor i;

[0123] ∪ represents a union;

[0124] exp(·) represents the exponential function;

[0125] z′ irepresents the graph convolution result of sensor i;

[0126] Represents element-wise multiplication;

[0127] represents the representation of sensor i;

[0128] π(i,k) represents the attention coefficient between sensor i and sensor k;

[0129] o i,f Represents the one-dimensional convolution result extracted according to the period f;

[0130] Conv1D(·) represents one-dimensional convolution;

[0131] o i Represents the one-dimensional convolution result;

[0132] represents the weight corresponding to the period f;

[0133] represents the sensor prediction value vector at time step t;

[0134] f θ {·} indicates stacked fully connected layers;

[0135] o N Represents the one-dimensional convolution result of sensor N;

[0136] z′ N Represents the graph convolution result of sensor N;

[0137] L MSE Indicates the minimum loss value;

[0138] T train Indicates the length of training data;

[0139] w represents the sliding window size;

[0140] s t represents the sensor true value vector at time step t;

[0141] ||·||2 represents the two-norm.

[0142] As an optional embodiment of the present invention, optionally, in step A3, optimizing the loss function by using a gradient descent algorithm includes:

[0143]

[0144] in, Represents the gradient of the loss function with respect to V during iteration;

[0145] V represents the sensor feature vector;

[0146] represents partial derivative;

[0147] L represents the loss value;

[0148] Represents the gradient of the loss function with respect to W during iteration;

[0149] W represents the weight matrix;

[0150] V t+1 represents the sensor feature vector at the t+1th iteration;

[0151] V t represents the sensor feature vector at the tth iteration;

[0152] δ represents the learning rate;

[0153] W t+1 Represents the weight matrix at the t+1th iteration;

[0154] W t represents the weight matrix at the tth iteration.

[0155] It should be noted that when using the gradient descent algorithm, the sensor feature vector V and the weight matrix W are used to optimize the loss value.

[0156] As an optional embodiment of the present invention, optionally, in step A2, the expression for calculating the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix is:

[0157]

[0158] Among them, Err i (·) represents the anomaly score of sensor i;

[0159] t represents the time step;

[0160] | indicates modulus;

[0161] represents the true value of sensor i at time step t;

[0162] represents the predicted value of sensor i at time step t;

[0163] a i (t) represents the normalized anomaly score of sensor i;

[0164] represents the mean;

[0165] represents standard deviation;

[0166] A(·) represents the final anomaly score;

[0167] Represents the maximum value among the i anomaly scores.

[0168] like Figure 4 As shown, in order to verify the performance of the above-mentioned time series data anomaly detection system, this embodiment installed the device on a server (configuration: Intel Xeon E5-2630 v4, 2.2GHz processor, 256G memory), and ran a simulation experiment for example analysis. In the example analysis, the time series data used comes from the time series data of a water plant system sensor. The example analysis uses the F1 score as an evaluation indicator of the accuracy of time series data anomaly detection. The higher the F1, the higher the anomaly detection accuracy.

[0169] Figure 4 This is a comparison of the accuracy of anomaly detection on time series data before and after applying the embodiments of the present invention. Figure 4 After applying the embodiment of the present invention, when performing time series data anomaly detection, the anomaly detection function under different periods will obtain different anomaly detection results, resulting in different detection accuracy. The first case represents the anomaly detection result under the conventional anomaly detection function, and the second case represents the anomaly detection result of adaptive fusion after applying the present invention.

[0170] It can be seen from the above technical scheme that the present invention specifically works on time series data, can perform anomaly detection in multiple dimensions for time series data, and can adaptively fuse the detection results of different anomaly detection functions from the detected anomaly results, and can solve the problem of efficient and high-accuracy anomaly detection of time series data in modern complex systems.

[0171] Example 2

[0172] A method for detecting anomalies based on time series data, the method comprising the system for detecting anomalies based on time series data.

[0173] As another optional embodiment of the present invention, optionally, the method further includes:

[0174] S1, collect time series data;

[0175] S2. Extracting periodic features from the time series data using Fourier transform;

[0176] S3, initializing parameters of the detection system;

[0177] S4. Constructing a loss function using the different periodic features and anomaly detection functions in the time series data;

[0178] S5, judging whether the iterative control variable in the parameter has reached the upper limit;

[0179] If so, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0180] If not, determine whether the loss function converges on the sensor feature vector and weight matrix;

[0181] S6. If yes, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix;

[0182] If not, the loss function is optimized using a gradient descent algorithm, and steps S5 to S6 are repeated;

[0183] S7: Fusing the detection results to generate an abnormality detection report.

[0184] It should be noted that when the method uses Fourier transform to extract periodic features in step S2, periodic patterns in time series data can be effectively identified. These periodic patterns help to understand the inherent laws of the data, thereby improving the accuracy of anomaly detection.

[0185] In step S3, parameter initialization is a key step to ensure that the detection system can quickly converge to the optimal solution. The initialization parameters include the learning rate, the initial value of the weight matrix, etc. Proper initialization can avoid the problem of gradient vanishing or gradient exploding, thereby improving training efficiency.

[0186] In step S4, by combining different periodic features and anomaly detection functions to construct a loss function, the detection system can perform anomaly detection in multiple dimensions.

[0187] In steps S5 and S6, the iterative control variable is used to control the number of training processes. When the number of iterations reaches the upper limit, the system will stop training and calculate the final detection results. If the loss function does not converge on the sensor feature vector and weight matrix, the gradient descent algorithm needs to be used to optimize the loss function to further improve the detection accuracy.

[0188] In step S7, the detection results of different anomaly detection functions are fused to generate a more comprehensive and accurate anomaly detection report. The fusion method can adopt a variety of strategies such as weighted average and voting mechanism to ensure the reliability of the final report.

[0189] In summary, the time series data anomaly detection method provided by the present invention can effectively detect anomalies in time series data from multiple dimensions, and improve the accuracy and efficiency of anomaly detection by adaptively fusing the detection results of different anomaly detection functions. This method is suitable for time series data anomaly detection in various complex systems and has broad application prospects.

[0190] Example 3

[0191] A computer-readable storage medium, comprising:

[0192] a memory having a computer program stored thereon;

[0193] A processor is used to execute the program in the memory to implement an anomaly detection method based on time series data.

[0194] It should be noted that the electronic device according to the embodiment of the present disclosure includes a processor and a memory for storing processor executable instructions, wherein the processor is configured to implement any of the above-mentioned cloud resource task scheduling methods with efficient optimization when executing the executable instructions.

[0195] Here, it should be noted that the number of processors can be one or more. At the same time, the electronic device in the embodiment of the present disclosure may also include an input device and an output device. Among them, the processor, memory, input device and output device may be connected through a bus or in other ways, which are not specifically limited here.

[0196] As a computer-readable storage medium, the memory can be used to store software programs, computer executable programs and various modules, such as: the program or module corresponding to the cloud resource task scheduling method with efficient optimization in the embodiment of the present disclosure. The processor executes various functional applications and data processing of the electronic device by running the software programs or modules stored in the memory.

[0197] The input device can be used to receive input numbers or signals. The signal can be a key signal related to user settings and function control of the device / terminal / server. The output device can include a display device such as a display screen.

[0198] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A time series data anomaly detection system, characterized in that: The system comprises: The acquisition module is used to collect the timing data of the device; A receiving module, connected to the acquisition module, and configured to receive the time series data; A time series period extraction module, connected to the receiving module, for extracting periodic features from the time series data; An anomaly detection module, connected to the time series period extraction module, is used to use the different periodic features in the time series data to match the corresponding anomaly detection function, detect the time series data, obtain a number of anomaly detection results, merge the several anomaly detection results, and generate an anomaly detection report; A storage module is connected to the receiving module and the anomaly detection module, and is used to store the time series data and the anomaly detection report.

2. The system for detecting anomalies based on time series data according to claim 1, characterized in that: The expression for extracting the periodic feature in the time series data by the time series period extraction module is: Among them, X(·) represents time series data, k represents the frequency index size, t represents the sensor number, N represents the Nth column of the time series data, x(·) represents the time series, and e represents the natural base.

3. The system for detecting anomalies based on time series data according to claim 1, characterized in that: The anomaly detection module comprises: A parameter initialization unit, used for initializing parameters of the system; An extraction unit, connected to the parameter initialization unit, the storage module and the time series period extraction module, is used to obtain latent features of different dimensions in the time series data using different periodic features, wherein the latent features include a neighbor time series latent feature matrix and a periodic time series data latent feature matrix, and obtain a plurality of anomaly detection results using the latent features, fuse the plurality of anomaly detection results, and generate an anomaly detection report; A result output unit is connected to the extraction unit and the storage module, and is used to obtain a detection result corresponding to the maximum anomaly score in the anomaly detection report, and use the detection result as a final anomaly detection result.

4. The system for detecting anomalies based on time series data according to claim 3, characterized in that: The step of the extraction unit obtaining the abnormality detection result comprises: A1. Constructing a loss function using the different periodic features and the anomaly detection function; A2. Determine whether the iterative control variable in the parameter has reached the upper limit; If so, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix; If not, determine whether the loss function converges on the sensor feature vector and weight matrix; A3. If yes, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix; If not, the loss function is optimized using a gradient descent algorithm, and steps A2 to A3 are repeated.

5. The system for detecting anomalies based on time series data according to claim 4, characterized in that: The expression of the loss function is: in, represents the sensor i vector after splicing, v i represents the sensor feature vector, represents the concatenation operation, W represents the weight matrix, represents the time series, π(,) represents the attention coefficient, i represents sensor i, j represents sensor j, LeakyReLU(·) represents the activation function, a ⊥ (·) represents the learning coefficient vector of the attention mechanism, represents the vector of sensor j after stitching, a i,j represents the attention coefficient of sensor i to sensor j, represents the neighbors of sensor i, ∪ represents the union, exp(·) represents the exponential function, z′ i represents the graph convolution result of sensor i, represents element-wise multiplication, represents the representation of sensor i, π(i,k) represents the attention coefficient between sensor i and sensor k, o i,f represents the one-dimensional convolution result extracted according to the period f, Conv1D(·) represents the one-dimensional convolution, o i represents the one-dimensional convolution result, represents the weight corresponding to the period f, represents the sensor prediction value vector at time step t, f θ {·} indicates stacked fully connected layers, o N represents the one-dimensional convolution result of sensor N, z′ N represents the graph convolution result of sensor N, L MSE represents the minimum loss value, T train represents the length of training data, w represents the sliding window size, s t represents the true sensor value vector at time step t, and ||·||2 represents the binary norm.

6. The system for detecting anomalies based on time series data according to claim 4, characterized in that: In step A3, optimizing the loss function by using the gradient descent algorithm includes: in, represents the gradient of the loss function to V during iteration, V represents the sensor feature vector, represents the partial derivative, L represents the loss value, represents the gradient of the loss function to W during iteration, W represents the weight matrix, V t+1 represents the sensor feature vector at the t+1th iteration, V t represents the sensor feature vector at the tth iteration, δ represents the learning rate, W t+1 represents the weight matrix at the t+1th iteration, W t represents the weight matrix at the tth iteration.

7. The system for detecting anomalies based on time series data according to claim 4, characterized in that: In step A2, the expression for calculating the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix is: Among them, Err i (·) represents the anomaly score of sensor i, t represents the time step, |·| represents the modulus, represents the true value of sensor i at time step t, represents the predicted value of sensor i at time step t, a i (t) represents the normalized anomaly score of sensor i, represents the mean, represents the standard deviation, A(·) represents the final anomaly score, Represents the maximum value among the i anomaly scores.

8. A method for detecting anomalies based on time series data, characterized in that: The method includes the time series data based anomaly detection system as described in any one of claims 1 to 7.

9. The method for detecting anomalies based on time series data according to claim 8, characterized in that: The method further comprises: S1, collect time series data; S2. Extracting periodic features from the time series data using Fourier transform; S3, initializing parameters of the detection system; S4. Constructing a loss function using the different periodic features and anomaly detection functions in the time series data; S5, judging whether the iterative control variable in the parameter has reached the upper limit; If so, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix; If not, determine whether the loss function converges on the sensor feature vector and weight matrix; S6. If yes, calculate the neighbor time series latent feature matrix and the periodic time series data latent feature matrix, and calculate the detection result according to the neighbor time series latent feature matrix and the periodic time series data latent feature matrix; If not, the loss function is optimized using a gradient descent algorithm, and steps S5 to S6 are repeated; S7: Fusing the detection results to generate an abnormality detection report.

10. A computer-readable storage medium, characterized in that: include: a memory having a computer program stored thereon; A processor is used to execute the program in the memory to implement a method for detecting anomalies based on time series data as described in any one of claims 8 and 9.

Images