Time series anomaly detection method based on progressive diffusion model in cloud environment

Abstract

The invention provides a time sequence anomaly detection method and system based on a progressive diffusion model, and the method comprises the steps: obtaining a to-be-detected anomaly time sequence, and training the to-be-detected anomaly time sequence to obtain a teacher Diffusion model; performing iterative training according to the teacher Diffusion model to obtain a plurality of student Diffusion models; according to the estimated reasoning time, determining an appropriate Diffusion model from a teacher Diffusion model and a plurality of student Diffusion models for reasoning; and detecting the to-be-detected abnormal time sequence by using a proper Diffusion model to obtain an abnormal detection result. According to the method, the calculation complexity of the diffusion model is reduced, and the method adapts to unbalanced resources and fluctuating network environments among the nodes in the cloud environment.

Description

Technical Field

[0001] The present invention relates to the field of information data processing technology, and in particular to a time series anomaly detection method based on a progressive diffusion model in a cloud environment. Background Art

[0002] A cloud-to-cloud environment primarily refers to a cross-domain, interconnected computing environment formed through open collaboration and resource sharing among different cloud service providers in the context of cloud computing technology. This environment provides users with more flexible scalability and richer computing resources to meet business needs in diverse scenarios. This environment holds broad application prospects, particularly in industrial control systems. However, the topic of how to detect anomalies in time series data collected by sensors and other devices within this environment holds significant application value.

[0003] Since inter-cloud environments also face issues such as uneven node performance and high network volatility, the performance and efficiency of time series anomaly detection are challenged. Traditional time series anomaly detection methods rely on manually defined features or statistical indicators to detect anomalies. This approach is relatively limited in feature extraction and may not capture complex patterns and hidden relationships in the data. In recent years, the continuous development of deep learning methods has reduced the reliance on manual feature engineering for time series anomaly detection tasks and has stronger pattern recognition capabilities. Diffusion models, in particular, have achieved the best performance in this task. However, existing diffusion models typically require multiple iterations to generate high-quality samples, which increases the computational complexity of the model. Moreover, if the data volume is large or real-time requirements are high, the computational complexity and training difficulty of the diffusion model may become limiting factors.

[0004] Therefore, faced with the challenges of unstable network, unbalanced node performance and high computational complexity in the inter-cloud environment, it is urgent to reduce the computational complexity of the diffusion model and adapt it to distributed scenarios to effectively utilize the scalability and computing resources of the inter-cloud environment. Summary of the Invention

[0005] The present invention provides a time series anomaly detection method based on a progressive diffusion model in an inter-cloud environment, which is used to solve the defects of the prior art time series anomaly detection method in an inter-cloud environment, such as large computational complexity, complex model and difficulty in training.

[0006] In a first aspect, the present invention provides a time series anomaly detection method based on a progressive diffusion model in a cloud environment, comprising: Obtain an abnormal time series to be detected, and train the abnormal time series to be detected to obtain a teacher diffusion model; Iteratively training the teacher diffusion model to obtain several student diffusion models; Determining a suitable diffusion model for reasoning from the teacher diffusion model and the plurality of student diffusion models according to the estimated reasoning time; The abnormal time series to be detected is detected using the appropriate Diffusion model to obtain an abnormality detection result.

[0007] According to a time series anomaly detection method based on a progressive diffusion model in a cloud environment provided by the present invention, an anomaly time series to be detected is obtained, and the teacher diffusion model is obtained by training the anomaly time series to be detected, including: Collecting time series data, performing data cleaning on the time series data, and obtaining the abnormal time series to be detected; Determine the context window size, step size, and deviation threshold of the abnormal time series to be detected, and obtain the learning rate, number of iterations, and batch size; Adding Gaussian noise to the abnormal time series to be detected through a forward process, and reconstructing the abnormal time series to be detected through a quasi-diffusion process to obtain a deformed time series; A one-dimensional Unet is determined as a Diffusion model component, the deformed time series is input into the Diffusion model component, a Diffusion model with a preset number of sampling steps is obtained through training, and the Diffusion model with the preset number of sampling steps is saved in a training node as the teacher Diffusion model.

[0008] According to a time series anomaly detection method based on a progressive diffusion model in a cloud environment provided by the present invention, a plurality of student diffusion models are obtained by iterative training of the teacher diffusion model, including: The teacher diffusion model is trained multiple times iteratively, each iteration adopting the same context window size, step size, and deviation threshold as the previous training model, and half of the preset sampling step number, loading the weights and structure saved by the previous training model, and training according to the preset loss function to obtain several new teacher diffusion models; Several new teacher Diffusion models are saved in the training node as the several student Diffusion models.

[0009] According to a time series anomaly detection method based on a progressive diffusion model in a cloud environment provided by the present invention, a suitable diffusion model is determined from the teacher diffusion model and the plurality of student diffusion models for inference according to an estimated inference time, including: Deploy the teacher diffusion model and the student diffusion models on each node in the cloud environment, and obtain the number of sampling steps of each model; Based on the denoising diffusion implicit model DDIM, the model inference time is estimated using the sampling steps of each model, and the model inference time is optimized using the knowledge distillation algorithm to obtain the optimized model inference time; According to the network forwarding time and the network upper limit threshold time, the optimized model inference time is screened, and the appropriate Diffusion model is determined for inference.

[0010] According to a time series anomaly detection method based on a progressive diffusion model in a cloud environment provided by the present invention, the anomaly time series to be detected is detected using the appropriate diffusion model to obtain an anomaly detection result, including: Establishing and reconstructing time series data according to the context window size and the step size; The reconstructed time series data is compared with the abnormal time series to be detected, and points and segments whose deviations exceed the deviation threshold are regarded as abnormal points and abnormal segments.

[0011] In a second aspect, the present invention further provides a time series anomaly detection system based on a progressive diffusion model in a cloud environment, comprising: An initial training module is used to obtain an abnormal time series to be detected and train the abnormal time series to be detected to obtain a teacher diffusion model; An iterative training module is used to obtain a plurality of student diffusion models through iterative training based on the teacher diffusion model; A determination module, configured to determine a suitable diffusion model for inference from the teacher diffusion model and the plurality of student diffusion models according to an estimated inference time; The detection module is used to detect the abnormal time series to be detected by using the appropriate Diffusion model to obtain an abnormality detection result.

[0012] In a third aspect, the present invention also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for detecting anomalies in a time series based on a progressive diffusion model in a cloud environment as described above is implemented.

[0013] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described methods for detecting anomalies in a time series based on a progressive diffusion model in a cloud environment.

[0014] The time series anomaly detection method based on the progressive diffusion model in the inter-cloud environment provided by the present invention reconstructs the time series through a diffusion model based on a one-dimensional Unet, thereby reducing the reliance on artificial feature engineering, mining potential time series features, discovering different anomaly types, and effectively improving the performance of the time series anomaly detection task. The diffusion model is compressed through progressive distillation, effectively reducing the computational complexity of the diffusion model and adapting to the lower-performance computing resources in the inter-cloud environment. The model selection algorithm is used to adapt to the fluctuating network environment in the inter-cloud network. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 1 is a flow chart of a time series anomaly detection method based on a progressive diffusion model in a cloud environment provided by the present invention; Figure 2 This is a diagram of the progressive distillation architecture of the Diffusion model provided by the present invention; Figure 3 This is a schematic diagram of the principle of detecting anomalies in time series data using the Diffusion model provided by the present invention; Figure 4 Schematic diagram of the structure of the time series anomaly detection system based on the progressive diffusion model in the cloud environment provided by the present invention; Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0017] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0018] Aiming at the limitations of the existing technology, reducing the computational complexity of the diffusion model and adapting to the uneven resources and fluctuating network environment between nodes in the cloud environment, the present invention proposes a time series anomaly detection method based on the progressive diffusion model in the cloud environment, such as Figure 1 As shown, including: Step 100: Obtain an abnormal time series to be detected, and train the abnormal time series to be detected to obtain a teacher Diffusion model; Step 200: Iteratively train the teacher diffusion model to obtain several student diffusion models; Step 300: Determine a suitable diffusion model for inference from the teacher diffusion model and the plurality of student diffusion models based on the estimated inference time; Step 400: Detect the abnormal time series to be detected using the appropriate Diffusion model to obtain an abnormality detection result.

[0019] The present invention proposes a time series anomaly detection method based on a progressive diffusion model in a cloud environment to improve the performance and efficiency of time series anomaly detection tasks and adapt to distributed scenarios. This includes the following three points: (1) In order to effectively utilize the complex dependencies between variables and improve the accuracy of anomaly detection, this paper proposes a diffusion model based on one-dimensional Unet as a multivariate time series anomaly detection teacher model, which performs anomaly detection by reconstructing the time series. (2) In order to reduce the computational complexity of the diffusion model and thus improve the inference speed, the present invention proposes a progressive knowledge distillation method to gradually reduce the number of sampling steps, improve the inference ability at low cost, and train a group of student models.

[0020] (3) In order to utilize the unevenly distributed resources and fluctuating network environment in a fine-grained manner in the cloud environment, this paper proposes a model selection algorithm to deploy and select appropriate models to run on different nodes.

[0021] Therefore, the specific implementation scheme of the embodiment of the present invention includes the following steps: Step 1: Based on multidimensional time series data, a diffusion model based on one-dimensional Unet is trained for time series anomaly detection. , given the context window size The historical data of Add Gaussian noise and then pass it through the inverse diffusion process Reconstruct the time series. Then compare it with the original time series to determine the time period or time point where the anomaly occurred.

[0022] Specifically, a one-dimensional Unet is used as a component of the Diffusion model, and a teacher model is trained based on the selected hyperparameters and time series. The collected time series data is cleaned, and the time series segments selected for multivariate time series data are preprocessed, and the context window size is selected. , step length , deviation threshold Parameters such as learning rate, number of iterations, batch size, etc. are found, and the deformed time series is used as the input of one-dimensional Unet to train the sampling steps to be The Diffusion model is saved in the training node as the teacher model.

[0023] In step 2, the diffusion model trained in step 1 is used as the teacher model to train a student model with fewer steps. This distillation is repeated iteratively. In each iteration, the student model attempts to simulate the results of the teacher model with one sampling step. After iterative distillation, the number of sampling steps of the student model is reduced to half that of the teacher. The current student model will be used as the teacher model for the next iteration, ultimately resulting in a set of student models.

[0024] Specifically, if Figure 2 As shown, the teacher model is used to train the student model with half the sampling steps, and the student model is used as the teacher model for the next stage to continue training. The same context window size as step 1 is selected , step length , deviation threshold Parameters such as , the number of sampling steps is halved, expressed as , and use this as the default setting for the student model in this step. Load the weights and structure saved by the teacher model obtained in step 1, and use the loss function Train the student model, and the loss function is defined as predict The mean square error of For in time The student model is then saved in the training node as the new teacher model and the previous step is repeated.

[0025] Step 3: Deploy the diffusion trained in Step 1 and Step 2 on each node in the cloud environment, and use the sampling steps of each model to calculate the number of steps. , respectively estimate their inference time. Estimate the network forwarding time and upper threshold time according to the network status and select the appropriate model.

[0026] Specifically, a series of trained diffusion models are deployed to nodes in the cloud environment, and a model is selected based on a selection algorithm. This embodiment proposes a heuristic model selection method to adapt to these dynamically changing network conditions. This method is based on the diffusion model and uses a knowledge distillation algorithm to optimize model inference time. Model inference time is proportional to the number of DDIM steps. By iteratively training the student model to approximate the performance of the teacher model, the model complexity can be adjusted to adapt to different network delays. In practical applications, such as multivariate time series data processing in industrial control networks, each dataset has a different timestamp. To handle anomalies promptly and avoid data backlogs, it is necessary to ensure that data processing can be completed between adjacent timestamps. The total delay includes model inference delay, fixed network delay, and additional delay caused by dynamic network conditions. By experimentally determining the coefficients of these fixed delays and adjusting the number of iterations based on the dynamic delay monitored in real time, the model can be optimized to adapt to the current network conditions, thereby achieving real-time anomaly detection.

[0027] Step 4: Based on the model and hyperparameters selected in step 3, including the context window size , step length , deviation threshold To perform anomaly detection. and Reconstruct the time series data and compare it with the data to be detected. The points and segments are marked as abnormal points or abnormal segments.

[0028] Specifically, if Figure 3As shown, based on the selected model and corresponding parameters, anomaly detection for time series is completed. Based on the selected model and hyperparameters, this embodiment can perform a detailed anomaly detection process. First, this embodiment uses a context window size 𝑐 to define the length of each data segment, which helps capture local patterns in the data. Then, a sliding window is used based on the step size 𝑡 to extract a series of subsequences from the original time series as model input. Next, the data within each window is reconstructed using the selected model. This assumes that a model that can effectively reconstruct time series data has been trained. In this way, this embodiment can obtain reconstructed time series data corresponding to the original data. Subsequently, the original time series data is compared point by point with the reconstructed time series data. For each time point or segment, the difference between it and the reconstructed data is calculated. If the difference between a time point or segment exceeds a set deviation threshold 𝑤, it is marked as an outlier. The selection of the threshold 𝑤 is crucial as it directly affects the accuracy and sensitivity of anomaly detection. Typically, this threshold is determined based on statistical information on the training data, such as a multiple of the standard deviation. Through the above process, this embodiment can collect all points or paragraphs marked as abnormal to form the final anomaly detection results. This model reconstruction-based method can effectively capture the patterns of normal behavior and identify abnormal behaviors that significantly deviate from these patterns.

[0029] The present invention reconstructs time series through a diffusion model based on a one-dimensional Unet, reducing dependence on artificial feature engineering, mining potential time series features, discovering different anomaly types, and effectively improving the performance of time series anomaly detection tasks; compressing the diffusion model through progressive distillation, effectively reducing the computational complexity of the diffusion model and adapting to lower-performance computing resources in the inter-cloud environment; and using a model selection algorithm to adapt to the fluctuating network environment in the inter-cloud network.

[0030] The time series anomaly detection system based on the progressive diffusion model in the cloud environment provided by the present invention is described below. The time series anomaly detection system based on the progressive diffusion model in the cloud environment described below and the time series anomaly detection method based on the progressive diffusion model in the cloud environment described above can be referenced to each other.

[0031] Figure 4 is a structural diagram of a time series anomaly detection system based on a progressive diffusion model in a cloud environment provided by an embodiment of the present invention. Figure 4 As shown, it includes: an initial training module 41, an iterative training module 42, a determination module 43 and a detection module 44, wherein: The initial training module 41 is used to obtain an abnormal time series to be detected, and train the abnormal time series to be detected to obtain a teacher Diffusion model; The iterative training module 42 is used to obtain a plurality of student diffusion models through iterative training based on the teacher diffusion model; The determination module 43 is used to determine a suitable diffusion model for inference from the teacher diffusion model and the plurality of student diffusion models according to the estimated inference time; The detection module 44 is used to detect the abnormal time series to be detected using the appropriate Diffusion model to obtain an abnormality detection result.

[0032] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute a time series anomaly detection method based on a progressive diffusion model in a cloud environment, the method comprising: obtaining an abnormal time series to be detected, training the abnormal time series to be detected to obtain a teacher diffusion model; iteratively training the teacher diffusion model to obtain several student diffusion models; determining a suitable diffusion model from the teacher diffusion model and the several student diffusion models for inference based on an estimated inference time; and detecting the abnormal time series to be detected using the suitable diffusion model to obtain an anomaly detection result.

[0033] Furthermore, the logic instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0034] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the time series anomaly detection method based on the progressive diffusion model in a cloud environment provided by the above-mentioned methods, the method comprising: obtaining an abnormal time series to be detected, training the abnormal time series to be detected to obtain a teacher diffusion model; iteratively training the teacher diffusion model to obtain several student diffusion models; determining a suitable diffusion model from the teacher diffusion model and the several student diffusion models for inference based on the estimated inference time; and detecting the abnormal time series to be detected using the suitable diffusion model to obtain an anomaly detection result.

[0035] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0036] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0037] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A time series anomaly detection method based on a progressive diffusion model in a cloud environment, It is characterized in that include: Obtain an abnormal time series to be detected, and train the abnormal time series to be detected to obtain a teacher Diffusion model; Iteratively training the teacher Diffusion model to obtain several student Diffusion models; Determining a suitable Diffusion model for reasoning from the teacher Diffusion model and the plurality of student Diffusion models according to the estimated reasoning time; The abnormal time series to be detected is detected using the appropriate Diffusion model to obtain an abnormality detection result.

2. According to claim 1, the time series anomaly detection method based on the progressive diffusion model in the cloud environment, It is characterized in that Obtain an abnormal time series to be detected, and train the abnormal time series to be detected to obtain a teacher Diffusion model, including: Collecting time series data, performing data cleaning on the time series data, and obtaining the abnormal time series to be detected; Determine the context window size, step size and deviation threshold of the abnormal time series to be detected, and obtain the learning rate, number of iterations and batch size; Adding Gaussian noise to the abnormal time series to be detected through a forward process, and reconstructing the abnormal time series to be detected through a quasi-diffusion process to obtain a deformed time series; A one-dimensional Unet is determined as a Diffusion model component, the deformed time series is input into the Diffusion model component, a Diffusion model with a preset number of sampling steps is obtained through training, and the Diffusion model with the preset number of sampling steps is saved in a training node as the teacher Diffusion model.

3. According to claim 2, the time series anomaly detection method based on the progressive diffusion model in the cloud environment, It is characterized in that According to the teacher Diffusion model, several student Diffusion models are obtained by iterative training, including: The teacher Diffusion model is trained for multiple iterations, each iteration adopts the same context window size, step size and deviation threshold as the last training model, and half of the preset sampling step number, loads the weights and structure saved in the last training model, and trains according to the preset loss function to obtain several new teacher Diffusion models; Several new teacher Diffusion models are saved in the training node as the several student Diffusion models.

4. According to claim 1, the time series anomaly detection method based on the progressive diffusion model in the cloud environment, It is characterized in that Determining a suitable Diffusion model for reasoning from the teacher Diffusion model and the plurality of student Diffusion models according to the estimated reasoning time includes: Deploy the teacher Diffusion model and the student Diffusion models on each node in the cloud environment, and obtain the sampling steps of each model; Based on the denoising diffusion implicit model DDIM, the model inference time is estimated by using the sampling steps of each model, and the model inference time is optimized by using the knowledge distillation algorithm to obtain the optimized model inference time; According to the network forwarding time and the network upper limit threshold time, the optimized model inference time is screened, and the appropriate Diffusion model is determined for inference.

5. According to claim 2, the time series anomaly detection method based on the progressive diffusion model in the cloud environment, It is characterized in that The abnormal time series to be detected is detected using the appropriate Diffusion model to obtain an abnormality detection result, including: Establishing and reconstructing time series data according to the context window size and the step size; The reconstructed time series data is compared with the abnormal time series to be detected, and points and segments whose deviations exceed the deviation threshold are taken as abnormal points and abnormal segments.

6. A time series anomaly detection system based on a progressive diffusion model in a cloud environment, It is characterized in that include: An initial training module is used to obtain an abnormal time series to be detected, and train the abnormal time series to be detected to obtain a teacher Diffusion model; Iterative training module, used for iterative training according to the teacher Diffusion model to obtain a number of student Diffusion models; A determination module, used for determining a suitable Diffusion model for reasoning from the teacher Diffusion model and the plurality of student Diffusion models according to the estimated reasoning time; The detection module is used to detect the abnormal time series to be detected by using the appropriate Diffusion model to obtain an abnormal detection result.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, It is characterized in that When the processor executes the program, the method for detecting anomalies of a time series based on a progressive diffusion model in a cloud environment as described in any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the method for detecting anomalies in time series based on a progressive diffusion model in a cloud environment as described in any one of claims 1 to 5 is implemented.

Images