Time sequence anomaly detection method under guidance of limited distribution mapping and pseudo anomaly calibration

Abstract

The invention relates to a time sequence anomaly detection method under the guidance of limited distribution mapping and pseudo anomaly calibration, namely RSAD, and the RSAD optimizes a normal representation learning process from two aspects: one is limited distribution mapping, and the other is pseudo anomaly calibration. In distribution limited mapping, original data distribution is converted into simple and compact Gaussian distribution, so that normal samples are more compact in a feature space. In pseudo-anomaly calibration, multiple types of pseudo-anomaly instances are generated from original input samples through a data perturbation operation, and anomaly-related knowledge is injected into the model. Through joint optimization of the two modules, the RSAD obtains a more accurate normal decision boundary.

Description

Technical Field

[0001] The present invention belongs to the technical field of time series data analysis, and is used to identify abnormal states of target systems in multiple application fields such as server detection, sensor activity detection, and water treatment. It specifically relates to a time series anomaly detection method guided by restricted distribution mapping and pseudo-anomaly calibration. Background Art

[0002] Time series anomaly detection (TSAD) is a critical task in many fields such as healthcare, network security, and fault diagnosis, which aims to identify significantly deviated abnormal patterns from large-scale monitoring data. This has important practical significance for avoiding economic losses and reducing security risks. Traditional anomaly detection models obtain supervisory signals from labeled data, which enables them to achieve advanced performance when the labels are correct. However, labeling data is a challenging and costly task. Therefore, time series anomaly detection is usually regarded as an unsupervised learning task.

[0003] Traditional time series anomaly detection models can be roughly divided into three categories: reconstruction-based methods, clustering-based methods, and autoregression-based methods. Traditional reconstruction methods use PCA and its variants to learn the latent representation of data and reconstruct normal data. Clustering-based methods divide data into several groups of clusters with similar characteristics, where data points that do not belong to any cluster or are very sparse within a cluster are considered anomalies. SVDD is a typical clustering method that identifies anomalies by learning a hypersphere with a minimum radius that includes all normal data and excludes unknown anomaly data from the hypersphere. Autoregression-based methods can effectively capture the underlying temporal correlation. These methods widely use autoregression (AR), autoregressive moving average (ARMA), and autoregressive integrated moving average (ARIMA) models to model historical data and predict the next data point or a continuous sequence value. Among them, anomalies are defined as data points or sequences that differ greatly from the true value. For example, Günnemann et al. used a multivariate autoregression model to model the basic behavior of users, thereby identifying abnormal time points where the rating distribution is inconsistent with the basic behavior. Moayedi et al. used the ARIMA model to analyze and model time series data to achieve network traffic prediction and anomaly detection. These methods have shown good performance in dealing with low-dimensional problems, but the lack of time information has limited the performance of the model in high-dimensional problems to a certain extent.

[0004] In recent years, thanks to the excellent learning and expression capabilities of deep neural networks, deep anomaly detection models have achieved encouraging results. Existing methods can be divided into two categories: reconstruction-based methods and prediction-based methods. The former reconstructs the original data based on the encoder-decoder architecture to learn normal representations and defines anomalies as input samples with high errors. The latter uses recurrent neural networks to model historical data to predict the next data point or a period of data, where data with a large difference between the predicted value and the true observed value are defined as abnormal. For example, Zhang et al. proposed a reconstruction network based on a variational autoencoder model and added an additional constraint network in the latent space, which allows the model to focus on reconstructing seemingly normal input samples while maintaining a high reconstruction error for abnormal samples to identify potential anomalies. Lai et al. combined convolutional neural networks (CNNs) with recurrent neural networks to extract dependencies between short-term local variables and long-term pattern trends in time, and used prediction errors to detect anomalies. Some recent methods combine reconstruction with prediction and achieve significant performance gains. For example, Wong et al. proposed an autoencoder with regression function. The model integrates the autoencoder and LSTM regressor, and can optimize the network parameters by using reconstruction and prediction errors at the same time, thereby improving the anomaly detection performance. Xiao et al. proposed a memory-enhanced adversarial autoencoder. By jointly training the two proxy tasks of reconstruction and prediction, the problem of incorrect reconstruction of abnormal samples in the autoencoder was alleviated, and the sensitivity of the model to anomalies was effectively improved. Some advanced architectures, such as neural networks and Transformers, have also been proposed to improve the performance of time series anomaly detection. In addition, the success of self-supervised learning in the field of computer vision has provided a new direction for time series anomaly detection. Darban et al. proposed a self-supervised contrastive representation learning method for time series anomaly detection. By constructing time series positive and negative sample pairs, normal samples are close to each other in the representation space, and abnormal samples are far away from each other, thereby optimizing normal representation learning and achieving advanced performance on univariate and multivariate time series anomaly benchmark datasets. Chen et al. introduced contrastive loss based on the deep one-class classification (DeepSVDD) anomaly detection model. This loss can effectively constrain the feature mapping of normal instances in the hypersphere space to prevent the occurrence of collapse solutions. Although these methods achieve excellent performance, they are still limited by the anomaly contamination problem, resulting in suboptimal performance. COUTA expands the single-class distance, i.e., the distance from the potential representation of a sample to the center of the hypersphere, to Gaussian space to capture the prediction uncertainty of the sample, where anomalies have higher uncertainty, and alleviates the negative impact of anomaly contamination by reducing the learning weight of abnormal samples.However, this method is random and in some cases, normal samples may show the same pattern as abnormal contamination, thus affecting the model's ability to handle abnormal contamination.

[0005] The challenges of unsupervised time series anomaly detection are: (1) Potential anomaly contamination. In the task of time series anomaly detection, the training data is usually regarded as a completely normal time series data set. However, due to the complexity of the data collection environment and the difficulty of annotating anomalies, obtaining a completely clean dataset becomes an almost impossible task. This leads to potential anomaly contamination that may interfere with the effective learning of normal features, resulting in serious overfitting. (2) Sparse anomaly prior knowledge. Existing methods focus on designing advanced neural network structures or learning objectives to optimize the representation learning quality of normal features. However, sparse anomaly prior knowledge makes it impossible for the model to accurately define the specific range of normal data, which easily leads to the model constructing an inaccurate and biased normal boundary, thereby affecting generalization performance and robustness.

[0006] Existing unsupervised time series anomaly detection methods assume that the training dataset is dominated by normal data, and learn and model the normal behavior or pattern of training samples by reconstruction or prediction to detect significantly deviated anomalies. However, the complexity of the collection environment and the difficulty of annotating data make it a difficult and costly task to obtain a completely clean training dataset. This makes these single-class learning methods susceptible to potential anomaly contamination, which biases the learning process of normal features, thereby affecting the learning quality of normal samples. In addition, the sparse prior knowledge of anomalies causes the model to learn an inaccurate and biased normal boundary, which limits the anomaly detection performance of the model to a certain extent. To solve the above problems, some methods filter possible abnormal samples through self-training or introduce additional components to ensure the accuracy of the training process. However, this filtering process usually also has the problem of abnormal contamination, and they may mistakenly filter some normal samples that are important for network training. In addition, some existing methods artificially introduce abnormal samples to make up for the missing abnormal knowledge during training to construct an accurate normal boundary. However, this method is very sensitive to the proportion of abnormal samples and is prone to interfere with the learning of normal features, thereby affecting the accuracy of anomaly detection. Summary of the invention

[0007] The purpose of the present invention is to solve the above problems and provide a time series anomaly detection method guided by restricted distribution mapping and pseudo-anomaly calibration, called RSAD. RSAD optimizes the normal representation learning process from two aspects: one is through restricted distribution mapping, and the other is through pseudo-anomaly calibration. In distribution restricted mapping, normal samples are made more compact in the feature space by converting the original data distribution into a simple and compact Gaussian distribution. In pseudo-anomaly calibration, various types of pseudo-anomaly instances are generated from the original input samples through data perturbation operations, and anomaly-related knowledge is injected into the model. By jointly optimizing the above two modules, RSAD obtains a more accurate normal decision boundary.

[0008] To achieve the above-mentioned purpose, the technical solution of the present invention is: a time series anomaly detection method guided by restricted distribution mapping and pseudo-anomaly calibration, which optimizes the normal representation learning process through a restricted distribution mapping module and a pseudo-anomaly calibration module; in the restricted distribution mapping module, the original input sample distribution is converted into a simple and compact Gaussian distribution, so that the normal sample is more compact in the feature space; in the pseudo-anomaly calibration module, various types of pseudo-anomaly instances are generated from the original input samples through data perturbation operations, and anomaly-related knowledge is injected into the model; and a more accurate normal decision boundary is obtained by jointly optimizing the restricted distribution mapping module and the pseudo-anomaly calibration module.

[0009] In one embodiment of the present invention, the restricted distribution mapping module is specifically implemented as follows:

[0010] The goal is to learn a normal hypersphere decision boundary with the smallest radius, so that it surrounds as many normal samples as possible and excludes abnormal samples; therefore, the single-class distance between the input sample and the center of the hypersphere can clearly define the degree of abnormality of the data; given the time domain convolutional coding network E and the original subsequence, i.e., the input sample s, the single-class loss is defined as:

[0011] L oc =||E(s)-c|| 2 (1)

[0012] Where c represents the center of the normal hypersphere in the feature space;

[0013] For the input sample s, first calculate the mean μ of its sample embedding E(s) s With standard deviation σ s :

[0014]

[0015]

[0016] Where B represents the batch size; then, E(s) is batch normalized to make it follow a Gaussian distribution:

[0017]

[0018] Where ∈ is a scalar to prevent numerical instability. Similarly, by calculating the mean μ of the entire training sample S c With standard deviation σ c Normalize the center of the hypersphere c and map it to a Gaussian distribution:

[0019]

[0020] Based on formula (5), the new training objective is obtained:

[0021]

[0022] By optimizing the single-class loss function of formula (6), the samples are distributed more compactly in the feature space.

[0023] In one embodiment of the present invention, ∈ is set to 1×10 -5 .

[0024] In one embodiment of the present invention, the pseudo-anomaly calibration module is specifically implemented as follows:

[0025] Define a data perturbation operation library T, where T = {Jitter, Scaling}, which is specifically defined as follows:

[0026] Jitter: By adding normal distribution noise m∈N(μ,σ 2 ) to generate pseudo-abnormal samples, which are defined as follows:

[0027] T(s)=[x 1 +m,x 2 +m,...,x t +m] (7)

[0028] Among them, x i is the original input sample, i=1,2,……t,μ=1,σ=0.03;

[0029] Scaling: Generate pseudo-abnormal samples by multiplying the original input sample by a random scalar λ, which is defined as follows:

[0030] T(s)=[λx 1 ,λx 2 ,...,λx t ] (8)

[0031] Where λ is fixed to 0.2;

[0032] The pseudo-anomaly sample T(s) is fed into the time-domain convolutional coding network to extract the feature E(T(s)) and normalize it to obtain its potential representation

[0033]

[0034] Among them, μ T(s) , σ T(s) are the mean and standard deviation of E(T(s));

[0035] A self-supervised training branch is designed to learn a more accurate normal boundary by training to distinguish original input samples from pseudo-anomaly samples; the loss function of the training is defined as follows:

[0036]

[0037] Where D represents the classifier, y - and + -1 and 1 respectively.

[0038] To further optimize the normal representation learning, similar to formula (6), the class separability between normal and abnormal is expanded by maximizing the single-class distance between the pseudo-abnormal sample and the center of the normal hypersphere in the Gaussian latent space:

[0039]

[0040] Therefore, the final loss of the pseudo-anomaly calibration module is defined as:

[0041] L P =αL c +L noc (12)

[0042] Where α is the weight coefficient of the classification loss.

[0043] In one embodiment of the present invention, the anomaly score of the method is defined as follows:

[0044] In the training phase, formula (6) and formula (12) are combined to obtain the overall training objective:

[0045] L Total =L oc +L P (13)

[0046] In the inference phase, to provide a quantitative measure of the degree of abnormality of time series data, the latent representation of the data in Gaussian latent space is compared with the center of the hypersphere. The single-class distance is used to measure the degree of deviation of the data from normality; formally, the anomaly score f(·) of sample s is defined as:

[0047]

[0048] In one embodiment of the present invention, the method is applied to fields including server detection, sensor activity detection, and water treatment, and is used to identify abnormal states of target systems in the fields including server detection, sensor activity detection, and water treatment.

[0049] Compared with the prior art, the present invention has the following beneficial effects: the present invention provides an unsupervised anomaly detection method based on restricted distribution mapping and pseudo-anomaly calibration, called RSAD. RSAD optimizes the normal representation learning process from two aspects: one is through restricted distribution mapping, and the other is through pseudo-anomaly calibration. In distribution restricted mapping, normal samples are made more compact in the feature space by converting the original data distribution into a simple and compact Gaussian distribution. In pseudo-anomaly calibration, various types of pseudo-anomaly instances are generated from the original input samples through data perturbation operations, and anomaly-related knowledge is injected into the model. By jointly optimizing the above two modules, RSAD obtains a more accurate normal decision boundary. Experimental results on 5 real-world data sets show that RSAD is superior to current technologies, and the results prove the effectiveness of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Flow chart of the method of the present invention.

[0051] Figure 2 Visualization of data distribution in feature space. (a) Visualization of data distribution in original feature space. (b) Visualization of data distribution in Gaussian feature space.

[0052] Figure 3 Performance of detecting point (global and contextual) anomalies in synthetic time series datasets. DETAILED DESCRIPTION

[0053] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0054] The present invention provides a time series anomaly detection method guided by restricted distribution mapping and pseudo-anomaly calibration, which optimizes the normal representation learning process through a restricted distribution mapping module and a pseudo-anomaly calibration module; in the restricted distribution mapping module, the original input sample distribution is converted into a simple and compact Gaussian distribution, so that the normal sample is made more compact in the feature space; in the pseudo-anomaly calibration module, various types of pseudo-anomaly instances are generated from the original input samples through data perturbation operations, and anomaly-related knowledge is injected into the model; and a more accurate normal decision boundary is obtained by jointly optimizing the restricted distribution mapping module and the pseudo-anomaly calibration module.

[0055] The following is the specific implementation process of the present invention.

[0056] 1. Network structure

[0057] like Figure 1As shown, the method of the present invention, namely the RSAD model, consists of two modules: a restricted distribution mapping module and a pseudo-anomaly calibration module. First, each time series maps the original input sample to the latent space through a temporal convolutional network (TCN) to obtain its feature representation. Then, in order to learn a more accurate normal decision boundary, RSAD optimizes the normal representation learning process from two aspects: one is through restricted distribution mapping, and the other is through pseudo-anomaly calibration. Specifically, in the distribution restricted mapping, the normal representation is made more compact in the feature space by converting the original unknown distribution into a Gaussian distribution. In the pseudo-anomaly calibration, various types of pseudo-anomaly samples are generated from the original input samples through data perturbation operations, and abnormal-related knowledge is injected into the model. In the training stage, in order to jointly learn and jointly capture the discriminative normal and abnormal time series features, RSAD uses a weight sharing strategy to enable the two temporal coding networks to jointly learn and optimize the same weight parameters, thereby benefiting from each other's learning process and improving the sensitivity to normal and abnormal data to optimize the detection performance. In the inference phase, the anomaly score of the time series is defined as the single-class distance between the input sample and the center of the normal hypersphere in the Gaussian latent space, where the data with a small single-class distance is defined as normal. The details are as follows:

[0058] 1.1 Restricted Distribution Mapping

[0059] The goal of RSAD is to learn a normal hypersphere decision boundary with the smallest radius so that it surrounds as many normal samples as possible and excludes anomalies. Therefore, the single-class distance between the input sample and the center of the hypersphere can clearly define the degree of abnormality of the data. Given the time-domain convolutional coding network E and the original subsequence s, the typical single-class loss is defined as:

[0060] L oc =||E(s)-c|| 2 (1)

[0061] where c represents the center of the normal hypersphere in the feature space.

[0062] However, this method can only ensure that normal data are contained within the decision boundary of the normal hypersphere, but cannot guarantee that they are evenly distributed in the hypersphere. This may cause the representation of normal data in the hypersphere to become sparse, resulting in incorrect decision boundaries, such as Figure 2 (a) shows. The present invention proposes a restricted distribution mapping, the core idea of ​​which is to transform the original data distribution into a Gaussian distribution, so that the normal data representation in the latent space is more compact and uniform, thereby providing a more accurate normal decision boundary, such as Figure 2 Specifically, for an input sample s, we first calculate the mean μ of its sample embedding E(s) s With standard deviation σ s:

[0063]

[0064]

[0065] Where B represents the batch size. Then, E(s) is batch normalized using the above statistics to make it follow a Gaussian distribution:

[0066]

[0067] where ∈ is a scalar to prevent numerical instability and is fixed to 1×10 -5 Similarly, by calculating the mean μ of the overall training samples S c With standard deviation σ c Normalize the center of the hypersphere c and map it to a Gaussian distribution:

[0068]

[0069] Based on formula (5) and formula (6), RSAD obtains a new training objective:

[0070]

[0071] By optimizing the single-class loss function, the samples are distributed more compactly in the feature space, thereby learning a more accurate normal decision boundary.

[0072] 1.2 Pseudo-anomaly calibration

[0073] The lack of abnormal knowledge is a key issue that is easily overlooked in the training process of single-class models. This may lead to deviations in the normal decision boundary learned by the model. Inspired by self-supervised learning, the present invention proposes pseudo-anomaly calibration, which generates various types of pseudo-anomaly samples from the original input samples through predetermined data perturbation operations, thereby injecting relevant knowledge about anomalies into the model and improving the class separability between normal and abnormal. Specifically, in order to generate pseudo-anomaly samples, the present invention defines a data perturbation operation library T, where T = {Jitter, Scaling}, which is specifically defined as follows:

[0074] Jitter: This data perturbation operation adds normally distributed noise m∈N(μ,σ 2 ) to generate pseudo abnormal samples, which are defined as follows:

[0075] T(s)=[x 1 +m,x 2 +m,...,x t +m] (7)

[0076] Where μ=1, σ=0.03.

[0077] Scaling: This data perturbation operation generates pseudo-abnormal samples by multiplying the original input samples by a random scalar λ, which is defined as follows:

[0078] T(s)=[λx 1 ,λx 2 ,...,λx t ] (8)

[0079] where λ is fixed to 0.2.

[0080] Then, the pseudo-anomaly sample T(s) is fed into the time domain encoding network to extract the feature E(T(s)) and normalize it to obtain its potential representation

[0081]

[0082] Next, a self-supervised training branch is designed to learn a more accurate normal boundary by training RSAD to distinguish between original input samples and pseudo-anomaly samples. The loss function of this training branch is defined as follows:

[0083]

[0084] Where D represents the classifier, y- and y + -1 and 1 respectively.

[0085] To further optimize the normal representation learning, similar to formula (6), the class separability between normal and abnormal is expanded by maximizing the single-class distance between the pseudo-abnormal sample and the center of the normal hypersphere in the Gaussian latent space:

[0086]

[0087] In summary, the final loss of the pseudo-anomaly calibration module is defined as:

[0088] L P =αL c +L noc (12)

[0089] Where α is the weight coefficient of the classification loss.

[0090] 1.3. Anomaly Scoring

[0091] In the training phase, formula (6) and formula (12) are combined to obtain the overall training objective of RSAD:

[0092] L Total =L oc +L P (13)

[0093] In the inference phase, in order to provide a quantitative measure of the degree of abnormality of the time series data, the latent representation of the data in the Gaussian latent space is compared with the center of the hypersphere The single-class distance is used to measure the degree to which the data deviates from normality. Formally, the anomaly score f(·) of sample s is defined as:

[0094]

[0095] 2. Example

[0096] To evaluate the effectiveness of the RSAD method, the present invention is tested on 5 public datasets, which cover multiple application areas including server monitoring, water treatment industry, human condition monitoring, smart environment and Internet of Things, and weather and celestial observation. The background of these datasets is described below, and their statistical results are summarized in Table 1.

[0097] Table 1 Dataset information summary

[0098]

[0099] (1) Secure Water Treatment dataset (SWaT): This dataset is derived from a scaled-down water treatment experimental platform consisting of 51 continuously running sensors for 11 days, of which 7 days are normal data and 4 days are abnormal data.

[0100] (2) Pooled Server Metrics (PSM): This dataset is derived from monitoring data collected from multiple application server nodes within eBay. It consists of 25 features and records relevant information describing server machine metrics.

[0101] (3) Daily and Sports Activities Dataset (DSADS): This dataset is derived from 19 daily and sports activities sensor data of 8 participants. In the anomaly detection task, five rare and intense activities such as running, going up and down stairs, skipping rope, and playing basketball are defined as abnormal, and the rest of the activities are defined as normal.

[0102] (4) NIPS-TS-SWAN: This dataset comes from NASA's SpaceWeather HMIActive Region Patches (SHARP) and is high-quality solar surface active region data for solar activity research and space weather forecasting.

[0103] (5) NIPS-TS-GECCO: This dataset comes from the 2018 Genetic and Evolutionary Computation Conference and is a drinking water quality detection dataset for the Internet of Things.

[0104] The present invention mainly uses P, R and F1 score as evaluation indicators. P is the precision, which indicates the ratio of the number of correctly predicted positive samples in the data set to the number of all positive samples predicted by the model; R is the recall, which indicates the ratio of the number of correctly predicted positive samples in the model to the number of all positive samples in the data set; F1 score is the harmonic mean of precision and recall.

[0105] 2.1 Implementation Details

[0106] The experimental environment of this invention is Windows 1164-bit operating system, and the NVIDIA GEFORCE RTX3070Ti graphics card is used for calculation. The video memory size is 8GB, and the CPU processor is 12th Gen Intel(R) Core(TM) i9-12900H@2.50GH. All our models are based on the python 3.8 operating environment, deep learning framework Pytorch1.12.1 and CUDA 11.6.

[0107] 2.2 Baseline Methods

[0108] To extensively evaluate the performance of the proposed RSAD, we conduct a comprehensive comparison with 14 baseline methods:

[0109] (1) Local outlier factor (LOF): LOF is an anomaly detection method based on density estimation. This method calculates the relative density of each sample separately and estimates whether the sample is a local anomaly sample by comparing the average reachable density of the sample itself with its k nearest neighbor samples.

[0110] (2) OCSVM: OCSVM is an anomaly detection method based on support vector machine. This method establishes an inner description area of ​​the data description, projects the sample into the feature space, and then determines whether it is an anomaly based on the distance between the sample and the decision interface, thereby achieving the purpose of detecting anomalies.

[0111] (3) AutoEncoder: AutoEncoder is a reconstruction-based anomaly detection method that uses an encoder to map the input data to a low-dimensional space and a decoder to reconstruct the original input to identify anomalies based on the reconstruction error.

[0112] (4) LSTM-ED: LSTM-ED is an end-to-end sequence learning method that uses Long Short-Term Memory (LSTM) to map the input sequence to a vector of fixed dimension, and then uses another deep LSTM to decode the target sequence from the vector. Since LSTM can capture long-term contextual information, LSTM-ED is able to learn rich temporal information.

[0113] (5) DeepSVDD: DeepSVDD is a clustering-based anomaly detection method that aims to learn a tight hypersphere boundary to cluster normal samples near the center of the sphere, and move abnormal samples away from the center of the sphere by minimizing the average distance from the center of the sphere to normal samples and maximizing the similarity between samples inside the sphere and the center of the sphere, thereby achieving anomaly detection.

[0114] (6) DAGMM: DAGMM is an anomaly detection method based on autoencoders and Gaussian mixture models. This method uses a deep autoencoder to obtain a low-dimensional representation of the input and reconstruction error, and optimizes the model using the reconstruction error and Gaussian mixture function likelihood function. By maximizing the probability density of normal samples and minimizing the probability density of abnormal samples, DAGMM can distinguish abnormal samples from normal samples and thus identify anomalies.

[0115] (7) OmniAnomaly: OmniAnomaly is a multivariate time series anomaly detection method based on random recurrent neural networks. It uses techniques such as random variable concatenation and plane normalized flow to learn a robust representation of time series data to capture normal patterns. It then reconstructs a low-dimensional representation of the input data and determines whether the data is abnormal based on the reconstruction probability.

[0116] (8) MTAD-GAT: MTAD-GAT is an anomaly detection method based on graph attention network, which uses graph attention layer to learn the complex dependencies of multivariate time series in time and feature dimensions, and jointly applies the results of prediction and reconstruction to improve the anomaly detection performance.

[0117] (9) NeuTraL: NeuTraL is a self-supervised anomaly detection method with learnable transformations, which encourages the embedded features of the original view and the transformed view to be close to each other in the semantic space, while the embedded features of different transformed views are far away from each other in the semantic space, thereby obtaining a more informative representation.

[0118] (10) SLMR: SLMR is an anomaly detection method based on unsupervised short-term and long-term mask representation learning. It integrates the prediction-based model with the reconstruction-based model, extracts the short-term local dependency patterns and long-term global trend patterns of multivariate time series through multi-scale residual dilated convolution and gated recurrent unit (GRU), and combines spatiotemporal mask self-supervised representation learning and sequence segmentation to understand the temporal context and feature correlation.

[0119] (11) TranAD: TranAD is a Transformer-based anomaly detection method that uses a focal score-based self-adjustment mechanism to achieve robust multimodal feature extraction and adversarial training to obtain training stability, and introduces a meta-learning mechanism to enable the model to quickly learn from limited data and adapt to anomaly detection tasks in new domains.

[0120] (12) COUTA: COUTA is an anomaly detection method based on single-class classification. It uses an uncertainty evaluation module to adaptively penalize samples with high prediction uncertainty to calibrate the erroneous learning of anomaly contaminated samples, and uses a native anomaly calibration module to generate multiple types of artificial anomaly samples from original samples to learn more accurate normal boundaries, which alleviates the problems of anomaly contamination and sparse anomaly knowledge to a certain extent.

[0121] (13) ECOD: ECOD is a probability-based anomaly detection method that estimates the underlying distribution of the input data using a nonparametric method by calculating the empirical cumulative distribution of each dimension of the data, and uses these empirical distributions to estimate the tail probability of each dimension of each data point. Finally, the anomaly score of each data point is calculated by aggregating the estimated tail probabilities across dimensions.

[0122] (14) AnomalyTransformer: AnomalyTransformer is a Transformer-based anomaly detection method that proposes a new anomaly determination criterion to identify anomalies by calculating the reconstruction error and the correlation difference between each time point and its adjacent area and the entire sequence, and uses a maximum and minimum strategy to amplify the normal-abnormal distinguishability of the correlation difference.

[0123] 2.3 Qualitative comparison

[0124] In order to qualitatively compare the detection effects of our algorithm with other excellent baseline algorithms on 5 real-world datasets, we conducted comparative experiments and showed the detection results of our model on the point anomaly dataset. Figure 3As shown in the figure, some baseline methods produce fluctuations in anomaly scores at certain normal moments, which has a great impact on the anomaly detection effect in the real world. However, our algorithm successfully avoids this situation. We are able to effectively identify abnormal states, showing high F1 scores in real abnormal situations and low scores in normal moments, which fully demonstrates the effectiveness of our algorithm, which is especially important when performing anomaly detection in the real world. In real scenarios, false anomaly warnings will lead to a double waste of human and economic resources, so time series anomaly detection models need to have high accuracy and low false alarm rates. Our algorithm can meet this practical demand well and has important practical significance.

[0125] 2.4 Quantitative comparison

[0126] In order to quantitatively compare the accuracy of time series anomaly detection for 14 methods (i.e., LOF, OC-SVM, AutoEncoder, LSTM-ED, DeepSVDD, DAGMM, OmniAnomaly, MTAD-GAT, NeuTral, ECOD, COUTA, SLMR, TranAD, Anomaly Transformer and the proposed algorithm), we conducted experiments on 5 baseline datasets and used P, R and F1 score to quantitatively evaluate the anomaly detection results. As shown in Table 2, RSAD achieved the best performance on all three benchmark datasets. Compared with the best results in the baseline, RSAD achieved an F1 score improvement of 1.04%, 5.2% and 0.76% on the PSM, SWaT and DSADS datasets, respectively. Compared with deep anomaly detection methods, traditional anomaly detection methods such as OCSVM and LOF have poor detection performance. The reason is that they do not consider temporal information. Deep anomaly detection methods use deep neural networks to obtain better representation learning capabilities, but their performance may be limited due to the influence of anomaly contamination. Based on advanced structures and training strategies, AnomalyTransformer and COUTA alleviated the negative impact of abnormal contamination to a certain extent and achieved excellent performance, but they still lag behind RSAD. The main reason is that RSAD expands the class separability between normal and abnormal data through the restricted distribution mapping module and the pseudo-anomaly calibration module, allowing the model to focus on learning more representative normal data to optimize the normal description, thereby producing a more accurate normal boundary.

[0127] Table 2 Quantitative results on three real-world datasets

[0128]

[0129]

[0130] The present invention further evaluates the performance of RSAD on the NIPS-TS-GECCO and NIPS-TS-SWAN datasets. Compared with the above three datasets, these two datasets contain more types of anomalies and can better reflect the comprehensive performance of the model. As shown in Table 3, RSAD still achieves the most advanced performance. Compared with COUTA, the proposed method achieves 19% and 0.59% performance improvements on the NIPS-TS-GECCO and NIPS-TS-SWAN datasets. Therefore, the algorithm of the present invention has the best anomaly detection effect on time series datasets.

[0131] Table 3 Quantitative results on the NIPS-TS dataset

[0132]

[0133] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A time series anomaly detection method guided by restricted distribution mapping and pseudo anomaly calibration, characterized in that: The normal representation learning process is optimized through the restricted distribution mapping module and the pseudo-anomaly calibration module. In the restricted distribution mapping module, the normal samples are made more compact in the feature space by converting the original input sample distribution into a simple and compact Gaussian distribution. In the pseudo-anomaly calibration module, various types of pseudo-anomaly instances are generated from the original input samples through data perturbation operations, injecting anomaly-related knowledge into the model; by jointly optimizing the restricted distribution mapping module and the pseudo-anomaly calibration module, a more accurate normal decision boundary is obtained.

2. The method for detecting time series anomalies under the guidance of restricted distribution mapping and pseudo-anomaly calibration according to claim 1, characterized in that: The restricted distribution mapping module is specifically implemented as follows: The goal is to learn a normal hypersphere decision boundary with the smallest radius, so that it surrounds as many normal samples as possible and excludes abnormal samples; therefore, the single-class distance between the input sample and the center of the hypersphere can clearly define the degree of abnormality of the data; given the time domain convolutional coding network E and the original subsequence, i.e., the input sample s, the single-class loss is defined as: L oc =||E(s)-c|| 2 (1) Where c represents the center of the normal hypersphere in the feature space; For the input sample s, first calculate the mean μ of its sample embedding E(s) s With standard deviation σ s : Where B represents the batch size; then, E(s) is batch normalized to make it follow a Gaussian distribution: Where ∈ is a scalar to prevent numerical instability. Similarly, by calculating the mean μ of the entire training sample S c With standard deviation σ c Normalize the center of the hypersphere c and map it to a Gaussian distribution: Based on formula (5), the new training objective is obtained: By optimizing the single-class loss function of formula (6), the samples are distributed more compactly in the feature space.

3. The method for detecting time series anomalies under the guidance of restricted distribution mapping and pseudo-anomaly calibration according to claim 2, characterized in that: ∈ takes the value of 1×10 -5 .

4. The method for detecting time series anomalies under the guidance of restricted distribution mapping and pseudo-anomaly calibration according to claim 2, characterized in that: The pseudo-anomaly calibration module is specifically implemented as follows: Define a data perturbation operation library T, where T = {Jitter, Scaling}, which is specifically defined as follows: Jitter: By adding normal distribution noise m∈N(μ,σ 2 ) to generate pseudo-abnormal samples, which are defined as follows: T(s)=[x1+m,x2+m,...,x t +m] (7) Among them, x i is the original input sample, i=1,2,……t,μ=1,σ=0.03; Scaling: Generate pseudo-abnormal samples by multiplying the original input sample by a random scalar λ, defined as follows: T(s)=[λx1,λx2,...,λx t ] (8) Where λ is fixed to 0.2; The pseudo-anomaly sample T(s) is fed into the time-domain convolutional coding network to extract the feature E(T(s)) and normalize it to obtain its potential representation Among them, μ T(s) , σ T(s) are the mean and standard deviation of E(T(s)); A self-supervised training branch is designed to learn a more accurate normal boundary by distinguishing original input samples from pseudo-anomaly samples; the loss function of the training is defined as follows: Where D represents the classifier, y - and + -1 and 1 respectively. To further optimize the normal representation learning, similar to formula (6), the class separability between normal and abnormal is expanded by maximizing the single-class distance between the pseudo-abnormal sample and the center of the normal hypersphere in the Gaussian latent space: Therefore, the final loss of the pseudo-anomaly calibration module is defined as: L P =αL c +L noc (12) Where α is the weight coefficient of the classification loss.

5. The method for detecting time series anomalies under the guidance of restricted distribution mapping and pseudo-anomaly calibration according to claim 4, characterized in that: The anomaly score of this method is defined as follows: In the training phase, formula (6) and formula (12) are combined to obtain the overall training objective: L Total =L oc +L P (13) In the inference phase, to provide a quantitative measure of the degree of abnormality of time series data, the latent representation of the data in Gaussian latent space is compared with the center of the hypersphere. The single-class distance is used to measure the degree of deviation of the data from normality; formally, the anomaly score f(·) of sample s is defined as:

6. The method for detecting time series anomalies under the guidance of restricted distribution mapping and pseudo-anomaly calibration according to claim 4, characterized in that: The method is applied to fields including server detection, sensor activity detection, and water treatment, and is used to identify abnormal states of target systems in fields including server detection, sensor activity detection, and water treatment.

Images