Multivariate time sequence anomaly detection method, system and product

Abstract

The invention relates to the technical field of data anomaly detection, and particularly discloses a multivariate time series anomaly detection method, system and product, and the method comprises the steps: building an anomaly detection framework which comprises a domain attention-based feature extractor, a domain attention-based feature predictor and a multi-domain anomaly discriminator which are connected in sequence; training the domain attention-based feature extractor and the domain attention-based feature predictor by using multivariate time series data of a source domain and a target domain to obtain a multivariate time series anomaly detection model; and performing multivariate time sequence anomaly detection by using the multivariate time sequence anomaly detection model. According to the method, a target domain with limited data and a plurality of source domains with rich data are aligned in distribution, so that cross reuse of data among different devices in a device group is realized; and the model is trained through a joint loss function constrained by domain attention to capture more comprehensive equipment state information.

Description

Technical Field

[0001] The present invention relates to the technical field of data anomaly detection, and in particular to a multivariate time series anomaly detection method, system and product. Background Art

[0002] Multivariate time series data is the most common form of monitoring data, which contains rich information about device status. Combining multivariate time series anomaly detection with intelligent technology has become an effective way to achieve this.

[0003] In actual anomaly detection tasks, the high incidence of anomalies exists not only in the middle and late stages of operation, but also widely in the early stages of equipment operation. In the early stages of equipment operation, anomalies often occur frequently due to quality problems, incorrect installation and maintenance, etc., and at this time they cannot provide enough training data to train a model with good generalization performance. Therefore, considering using sufficient historical data accumulated by the same or similar equipment to train the model, but due to differences in equipment models, working environments, and working conditions, there are still large differences in the data collected between devices. Directly using these data for training will not produce satisfactory results on the target system.

[0004] In the problem of anomaly detection in time series, most studies focus on classification tasks, and the source domain is supervised during the training process, that is, the data in the source domain has been labeled, which is usually difficult for time series data. Therefore, there is a data shortage problem in the multivariate time series anomaly detection task. Summary of the invention

[0005] The present invention aims to solve the problem of data shortage in multivariate time series anomaly detection tasks. To this end, the present invention provides a multivariate time series anomaly detection method, system and product, which adopts a three-level network structure that can integrate knowledge from multiple source domains, and sequentially completes the extraction of common features, domain alignment of the target domain and the source domain, and multi-domain anomaly discrimination. The present invention aligns the target domain with limited data and multiple data-rich source domains in distribution, respectively, to achieve cross-reuse of data between different devices in the device group; trains the model through a joint loss function constrained by domain attention to capture more comprehensive device status information; and identifies abnormal behavior on the target domain from target domain anomaly detection results associated with different source domains through plurality voting.

[0006] The present invention provides a multivariate time series anomaly detection method, and the technical solution adopted is as follows: Building an anomaly detection framework, the anomaly detection framework includes a domain attention-based feature extractor, a domain attention-based feature predictor, and a multi-domain anomaly discriminator connected in sequence, the domain attention-based feature extractor is based on a BiGRU network and includes multiple double-layer sub-networks; Using multivariate time series data of the source domain and the target domain to train the domain attention-based feature extractor and the domain attention-based feature predictor to obtain a multivariate time series anomaly detection model; The multivariate time series anomaly detection model is used to perform multivariate time series anomaly detection.

[0007] Furthermore, each of the two-layer subnetworks corresponds to a source domain, and the two-layer subnetwork includes a first subnetwork and a second subnetwork, wherein the first subnetwork is used to map multivariate time series data of different source domains to the same common space by sharing parameters; and the second subnetwork is used to receive common features from the first subnetwork and extract features related to the corresponding source domain.

[0008] Furthermore, when training the domain attention-based feature extractor, the maximum mean difference is used to estimate the difference between the source domain and the target domain distribution, and the MMD loss based on domain attention is used. The calculation formula is: in, Indicates The domain importance coefficient of the source domain, is the total number of source domains, represents the domain alignment loss, Indicates the input Multivariate time series data from source domains, represents the multivariate time series data of the input target domain, Indicates The mapping of the first subnetwork of the domain attention-based feature extractor to the source domains, Indicates The first sub-network parameters corresponding to the source domain, Indicates The mapping of the second sub-network of the domain attention-based feature extractor to the source domains, Indicates The second sub-network parameters corresponding to the source domain.

[0009] Further, Domain importance coefficient of source domains The calculation formula is: in, represents the learnable weight matrix, represents the transpose of a matrix, represents a nonlinear activation function, Represents a splicing operation, Indicates The domain attention network weights of the source domain, Indicates The source domain output vector of the domain attention-based feature extractor corresponding to the source domain, Indicates The target domain output vector of the domain attention-based feature extractor corresponding to the source domain, Represents an exponential function with the natural constant e as the base.

[0010] Furthermore, the domain attention-based feature predictor adopts a multi-layer perceptron.

[0011] Furthermore, the domain attention-based feature predictor is trained on multiple source domains and optimized using the mean square error loss based on domain attention. The loss calculation formulas on the source domain and the target domain are respectively: in, represents the loss corresponding to the source domain, represents the loss corresponding to the target domain, represents the mean square error loss, Indicates Domain attention-based feature predictors corresponding to source domains, Indicates The feature predictor parameters corresponding to the source domain, Indicates The true value of the source domain, Represents the true value of the target domain; Total loss The calculation formula is: in, A hyperparameter representing the balanced loss.

[0012] Furthermore, according to the prediction values ​​under different source domain supervision output by the domain attention-based feature predictor, the multi-domain anomaly discriminator calculates the final prediction result using the majority voting method.

[0013] Furthermore, the process of calculating the final prediction result by the multi-domain anomaly discriminator is as follows: According to the predicted values ​​under supervision of different source domains output by the domain attention-based feature predictor and the true observation values ​​corresponding to different source domains, the state score corresponding to each source domain is calculated. The formula for calculating the status score is: in, Indicates the status score, It means to find the maximum value, Indicates The predicted value of a variable, Indicates The actual observed value of the variable, Indicates The interquartile range of the predicted values ​​of the variables, express the median of represents the total number of variables; Determine the target value state of the corresponding source domain according to the state score. If the state score is greater than a threshold, the target value state is abnormal and marked as 1; otherwise, the target value state is normal and marked as 0; The target value states are combined using a majority voting method to obtain a final prediction result.

[0014] The present invention also provides a multivariate time series anomaly detection system, which adopts the following technical solution: comprising: A framework building module and a training module, wherein the framework building module and the training module are connected, The framework building module is used to build an anomaly detection framework, wherein the anomaly detection framework includes a domain attention-based feature extractor, a domain attention-based feature predictor, and a multi-domain anomaly discriminator connected in sequence, wherein the domain attention-based feature extractor is based on a BiGRU network and includes multiple double-layer sub-networks; The training module is used to train the domain attention-based feature extractor and the domain attention-based feature predictor using multivariate time series data of the source domain and the target domain to obtain a multivariate time series anomaly detection model; the multivariate time series anomaly detection model is used to perform multivariate time series anomaly detection.

[0015] The present invention also provides a computer program product, including a computer program, which implements the above-mentioned multivariate time series anomaly detection method when executed by a processor.

[0016] The above one or more technical solutions in the embodiments of the present invention have at least one of the following technical effects: 1. The present invention designs a three-level network structure including a domain attention-based feature extractor, a domain attention-based feature predictor and a multi-domain anomaly discriminator, which can extract domain-invariant representations from multiple sources, thereby generalizing well in the target domain.

[0017] 2. The present invention also designs a domain alignment loss and a time series prediction loss that combine domain attention, which helps to make full use of the favorable information of multiple different source domains when training the model and reduce the risk of negative transfer.

[0018] 3. The effectiveness and superiority of the present invention are verified by studying two real-world multivariate time series anomaly detection datasets: the server cluster dataset (SMD) and the wind turbine cluster dataset (WTD). The experimental results show that the present invention can significantly improve the performance of device cluster anomaly detection.

[0019] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a flow chart of the method provided by the present invention.

[0022] Figure 2 This is a graph showing the performance of the model under different numbers of training sets under the WTD data set provided by the present invention.

[0023] Figure 3 It is a graph of anomaly detection results of various components of AMDAN under the SMD data set provided by the present invention.

[0024] Figure 4 It is a graph of anomaly detection results of various components of AMDAN under the WTD data set provided by the present invention.

[0025] Figure 5 It is a distribution diagram of different source domain and target domain features before and after alignment under the WTD dataset provided by the present invention.

[0026] Figure 6 It is a distribution diagram of different source domain and target domain features before and after alignment under device No. 1 of the SMD dataset provided by the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention. The following embodiments are used to illustrate the present invention, but cannot be used to limit the scope of the present invention.

[0028] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0029] Due to the success of deep networks in capturing spatiotemporal relationships of complex data, they have attracted more and more attention in the field of multivariate time series anomaly detection. However, this advantage can only be manifested when there is sufficient training data. There is a problem of data shortage in the multivariate time series anomaly detection task. The present invention builds a framework consisting of a feature extractor, a feature predictor, and a multi-domain anomaly discriminator. The feature extractor is used to extract domain-invariant features in the target device and source device data, while the feature predictor can directly use the data in the source device to directly help predict future values ​​on the target device to calculate the state score. In a multivariate domain adaptation network, negative transfer may occur due to distribution differences between source domains. For this reason, the present invention proposes a domain alignment loss and a time series prediction loss based on a domain attention mechanism to fully utilize the favorable information of different source domains, thereby reducing the negative impact that distribution differences between different domains may bring during the transfer learning process.

[0030] Combine the following Figures 1 to 6 The present invention is further described in detail, and a multivariate time series anomaly detection method, system and product of the present invention are described: In this embodiment, Figure 1 As shown, a multivariate time series anomaly detection method is provided, comprising the following steps: Step 1: Build an anomaly detection framework, which includes a domain attention-based feature extractor, a domain attention-based feature predictor, and a multi-domain anomaly discriminator connected in sequence.

[0031] In this embodiment, the domain attention-based feature extractor is based on the BiGRU network and learns domain-invariant features between the source domain and the target domain respectively.

[0032] The domain attention-based feature extractor includes a plurality of two-layer subnetworks, each of which corresponds to a source domain. The two-layer subnetwork includes a first subnetwork and a second subnetwork with the same structure. The first subnetwork is used to map multivariate time series data of different source domains to the same common space by sharing parameters, that is, all the first subnetworks share weights. The second subnetwork is used to receive common features from the first subnetwork and extract features related to the corresponding source domain.

[0033] In this embodiment, the domain attention-based feature predictor uses a multi-layer perceptron, each of which corresponds to a source domain.

[0034] In this embodiment, according to the prediction values ​​under different source domain supervision output by the domain attention-based feature predictor, that is, the output results of multiple multi-layer perceptrons, the multi-domain anomaly discriminator uses the majority voting method to calculate the final prediction result.

[0035] Step 2: Use the multivariate time series data of the source domain and the target domain to train the domain attention-based feature extractor and the domain attention-based feature predictor to obtain a multivariate time series anomaly detection model.

[0036] In multi-source transfer learning for time series anomaly detection tasks, due to differences in data distribution, different source domains play different roles in assisting target domain feature learning. In other words, different source domains may show different importance. Therefore, the present invention introduces a self-attention mechanism to learn the importance of different source domains to the target domain.

[0037] Given the output vector based on different source domain feature extractors , , and the output vectors of different target domain feature extractors , ,in, Indicates the total number of source domains, represents the dimension of the vector, represents the real number domain. Based on these two output vectors, the domain importance coefficient is calculated. Usually, in order to obtain better expressiveness, before calculating the importance of any source domain, each output vector is first mapped to a more advanced feature space. To this end, the present invention designs a domain attention network weight specific to the source domain. , , maps each output vector into the same feature space, where represents the dimension of the latent vector after mapping. The importance of the source domain can be expressed as follows: in, Self-attention networks for enforcing domain attention. Indicates The domain attention network weights of the source domain, Indicates The source domain output vector of the domain attention-based feature extractor corresponding to the source domain, Indicates The target domain output vector of the domain attention-based feature extractor corresponding to the source domain. Indicates The importance of the source domain.

[0038] In order to facilitate the comparison of importance between different source domains, the softmax function is used to normalize the importance of all source domains to obtain the domain importance coefficient.

[0039] No. Domain importance coefficient of source domains The calculation formula is: in, represents the learnable weight matrix, , represents the transpose of a matrix, represents a nonlinear activation function, Represents a splicing operation, Indicates The domain attention network weights of the source domain, Indicates The source domain output vector of the domain attention-based feature extractor corresponding to the source domain, Indicates The target domain output vector of the domain attention-based feature extractor corresponding to the source domain, represents an exponential function with the natural constant e as the base. The domain attention coefficient depends entirely on the characteristics of the source domain and the target domain and is learnable. Obviously, the larger the domain attention coefficient, the more domain-invariant features under the source domain will be conducive to the accuracy of anomaly detection, otherwise it will increase the risk of negative transfer.

[0040] This embodiment uses the domain attention-based feature extractor containing a two-layer subnetwork to learn the domain-invariant features of each source domain and target domain. The core idea is to align the distribution of each source domain and target domain. To this end, this embodiment selects the maximum mean difference (MMD) to estimate the difference between different distributions. For any given source domain and target domain, assume that their distributions are and The process of MMD measuring the distance between their marginal distributions is as follows: first, map the source domain features and the target domain features to the reproducing kernel Hillbert space (RKHS), then calculate their expectations in the space respectively, and the final MMD is the Euclidean distance between the expectations. The calculation formula is as follows: in, express and The maximum average difference between represents the Euclidean distance, Represents a characteristic kernel The reconstruction kernel Hilbert space, represents the sample expectation, represents the function that maps the original data to RKHS, Represents the original data of the source domain, Represents the original data of the target domain.

[0041] However, in the actual calculation process, it is impossible to directly obtain the expected value of the sample. Therefore, the expected unbiased estimate, that is, the mean of the sample, is used to complete the calculation instead. In addition, since the mapping function It is usually not fixed, in other words, it is difficult to directly select or define this function. For ease of calculation, the MMD is squared, the inner product between the mapping functions is obtained, and then expressed using the sum function. Domain alignment loss based on MMD can be formulated as: in, represents the number of samples in the source domain, represents the number of samples in the target domain, The source domain The original data, The target domain The original data.

[0042] By expanding and simplifying the formula, we can further obtain the domain alignment loss calculated by the kernel function: in, is the Gaussian kernel function. According to this formula, the MMD distance between each source domain and target domain pair can be obtained.

[0043] When the domain attention-based feature extractor is trained, the maximum mean difference is used to estimate the difference between the source domain and the target domain distribution. According to the above formula, the MMD loss based on domain attention can be obtained. The calculation formula is: in, Indicates The domain importance coefficient of the source domain, is the total number of source domains, represents the domain alignment loss, Indicates the input Multivariate time series data from source domains, represents the multivariate time series data of the input target domain, Indicates The mapping of the first subnetwork of the domain attention-based feature extractor to the source domains, Indicates The first sub-network parameters corresponding to the source domain, Indicates The mapping of the second sub-network of the domain attention-based feature extractor to the source domains, Indicates The second sub-network parameters corresponding to the source domain.

[0044] The feature predictor is trained on multiple source domains. For the same target sample, it is expected that the best prediction effect can be achieved on different source domains. To this end, the network is optimized by minimizing the mean square error (MSE) between the predicted value and the actual value on both the source domain and the target domain. Therefore, the feature predictor based on domain attention is trained on multiple source domains and optimized using the mean square error loss based on domain attention. The calculation formulas for the losses on the source domain and the target domain are: in, represents the loss corresponding to the source domain, represents the loss corresponding to the target domain, represents the mean square error loss, Indicates Domain attention-based feature predictors corresponding to source domains, Indicates The feature predictor parameters corresponding to the source domain, Indicates The true value of the source domain, Represents the true value of the target domain. Minimizing this loss will encourage different regressors to adjust their decision boundaries, thereby making full use of favorable information from different source domains. Therefore, this embodiment is able to achieve robust and better knowledge aggregation by integrating the anomaly detection results of multiple source domain networks.

[0045] Finally, the above three losses are combined in a weighted manner to balance the contribution of different losses to the network. The calculation formula is: in, A hyperparameter representing the balanced loss.

[0046] Therefore, during the training process, the parameters of this embodiment can be minimized by The training used the Adam optimizer with a learning rate of 0.001, a batch size of 128, and 200 epochs.

[0047] Step 3: Use the multivariate time series anomaly detection model to perform multivariate time series anomaly detection.

[0048] After the offline training in step 2 is completed to obtain the optimal multivariate time series anomaly detection model, this embodiment applies it to the task of online anomaly detection. The main purpose of the offline training process is to capture the normal behavior patterns in the input data of the source domain and the target domain, and calculate a state score based on the multiple regression prediction values ​​of the target domain obtained under the supervision of different source domains. Therefore, it is worth noting that only data from the normal operating state of the device or entity is selected during the training process. In the online anomaly detection process, the data may contain data in both normal and abnormal states. Using the model trained in the training process, the same method is used to calculate the state score of the test set under the supervision of each source domain. If the score is higher than a defined anomaly threshold, the observed data at the timestamp is judged to be abnormal, otherwise it is normal. Finally, the majority voting method is used to determine the final prediction result.

[0049] The specific process of the multi-domain anomaly discriminator calculating the final prediction result is: According to the predicted values ​​under supervision of different source domains output by the domain attention-based feature predictor and the true observation values ​​corresponding to different source domains, the state score corresponding to each source domain is calculated. The formula for calculating the status score is: in, Indicates the status score, It means to find the maximum value, Indicates The predicted value of a variable, Indicates The actual observed value of the variable, Indicates The interquartile range of the predicted values ​​of the variables, express The median of Indicates the total number of variables.

[0050] in, Represents the multivariate time series data input in the online anomaly detection process, which is calculated by the trained domain attention-based feature extractor and domain attention-based feature predictor. .

[0051] The target value state of the corresponding source domain is determined according to the state score. If the state score is greater than a threshold, the target value state is abnormal and marked as 1. Otherwise, the target value state is normal and marked as 0. The threshold is determined according to the actual usage scenario.

[0052] In the special scenario of multi-source domain adaptation, the judgment result is a set of anomaly detection results under supervision of all source domains. ,in, Indicates The target value state under the source domain, .

[0053] The majority voting method The target value states are combined to obtain the final prediction result.

[0054] Final prediction results It is expressed as: in, Indicates rounding.

[0055] Since the selection of thresholds involves complex domain knowledge and the existing methods have different standards, in order to avoid introducing additional hyperparameters and facilitate comparison with existing models, this embodiment uses the method of traversing the maximum and minimum scores of the test data set to test possible anomaly thresholds and reports the results associated with the highest F1 score.

[0056] In order to fully verify the anomaly detection performance of the multivariate time series anomaly detection model (AMDAN), this embodiment uses two data sets from real scenarios, including a server cluster data set SMD from an Internet company and a wind turbine cluster data set WTD from a large wind farm.

[0057] 1. Dataset 1.1 Server Cluster Dataset SMD This embodiment focuses on the anomaly detection problem when the historical monitoring data of the server is insufficient, which is of great significance for server systems that are newly added or lack an initial monitoring system. Therefore, the SMD data set is selected to verify the ability of the AMDAN-based anomaly detection method under the premise of insufficient historical data. The SMD data set is a public data set collected from the server cluster of a large Internet company, with a collection time of 5 weeks and a sampling interval of 1 minute. The server cluster is divided into three groups, with a total of 28 servers, of which 38 monitoring variables are collected for each server, such as CPU load, memory usage, and network usage. For the monitoring data of each server, SMD divides it into two subsets of equal size: the first half contains only the monitoring data under normal operating conditions of the equipment, which is used as a training set, while the second half contains data under abnormal and normal conditions that have been accurately labeled, which is used as a test set for the model.

[0058] The preprocessing of the SMD data set is mainly data verification and data normalization. Among the 28 open source server data, some machines experienced service changes during data collection, resulting in serious concept drift in the distribution of training and test data, which not only cannot accurately evaluate the performance of the model, but also does not meet the research point of this embodiment. Therefore, this embodiment only selects 11 of them for experiments. In addition, the minimum-maximum normalization method (Min-MaxNormalization) is used to normalize the data to maintain the original data distribution while improving the training process of the model. One of the 11 servers was selected as the target server, and the remaining 10 were used as source servers to test this embodiment.

[0059] 1.2 Wind Turbine Group Dataset WTD The WTD dataset was collected from four real wind farms located in different regions, with a collection period of one year and a sampling interval of one second. Each wind turbine collected 32 monitoring variables, such as hub speed, main bearing temperature, and pitch motor current. Of the four wind turbines, three only contain data collected under normal operating conditions, and the data of the other one is divided into two parts, one containing a limited amount of normal data, and the other containing both normal and main bearing cracking abnormal data.

[0060] The data preprocessing of the WTD data set mainly includes missing value processing and data normalization. Due to the complex working environment of the wind farm, this will inevitably lead to a certain number of missing values ​​in the collected data. However, improper filling of missing data may affect the research conclusions. Therefore, the missing values ​​are first deleted directly to ensure the reliability of the research results. For this data set, this embodiment also uses the minimum-maximum normalization method to standardize the data. And 3 units containing only normal state data are used as source units, and units containing both abnormal and normal data are used as target units. In the experiment, the target unit training set is also selected for training at 10%, 20%, 40%, 60%, and 100% to verify the anomaly detection results in the scenario of insufficient target data.

[0061] The details of the above two datasets are shown in Table 1.

[0062] Table 1 Dataset details

[0063] 2. Parameter selection In the experiment, this embodiment uses the same network structure and hyperparameters to test the two data sets. In order to adapt to the migration of multivariate time series knowledge and simplify the model, for the feature extractor, the gated recurrent unit (GRU) is used to learn the complex dynamic dependencies between multiple time variables. Compared with the long short-term memory network (LSTM), the GRU structure is simpler and runs faster, so it is easy to expand the scale of the model in multi-source domain scenarios. In addition, the GRU is configured in a bidirectional valid mode to better capture the time series context information. The feature predictor is responsible for learning meaningful feature representations from implicit vectors aligned to different source domains and outputting prediction results. In the prediction network, a layer normalization (LN) layer is added to prevent gradient explosion during training. In addition, during the training process, the balance factor was set to 0.5, and the model was trained using the Adam optimizer with a standard batch gradient descent algorithm, where the initial learning rate was set to 0.001, and the learning rate was adjusted at equal intervals with a cycle of 20 iterations, with the adjustment amplitude being 20% ​​of the original learning rate. The detailed network structure and hyperparameters are shown in Tables 2 and 3, respectively.

[0064] Table 2 Model network structure details

[0065] In Table 2, num_layers represents the number of layers, batch_first represents a Boolean parameter used to specify the dimension order of the input data, bidirectional represents bidirectional, Linear represents a linear layer, in_features represents input features, out_features represents output features, bias represents bias, LayerNorm represents layer normalization, and ReLU represents an activation function.

[0066] Table 3. Selection of hyperparameters in the model

[0067] 3. Evaluation method During the test, precision, recall, F1 and AUC were selected as evaluation indicators to compare the performance of the baseline and the proposed model. , as well as , TP represents true positive, FP represents false positive, and FN represents false negative. For these indicators, they all need to be obtained under a certain threshold. Therefore, due to different threshold selection methods, there are large differences in indicator values ​​between different tasks. The threshold selection method needs to be combined with industry knowledge related to the data set, so the best F1 value is traversed and found for reporting. Area Under ROC Curve (AUC, area under the ROC curve) is not affected by the threshold selection and can be used to compare the performance of the model between different tasks. Therefore, AUC is also selected as the evaluation indicator of the model.

[0068] 4. Baseline Model To verify the overall performance of the AMDAN architecture, it was compared with 21 state-of-the-art multivariate time series unsupervised anomaly detection methods in five categories. These methods include: Non-transfer multivariate time series anomaly detection methods, LSTM-NDT, LSTM-VAE, Transformer, MTAD-GAT, USAD, GDN and STGAT.

[0069] Pre-training-fine-tuning transfer learning method, LSTM-NDT-Finetuning, GDN-Finetuning, STGAT-Finetuning, Transformer-Finetuning, LSTM-VAE-Finetuning, MTAD-GAT-Finetuning.

[0070] Single-source domain transfer learning methods, DADRN, LSTM-DANN and TCN-DAL.

[0071] Multi-source domain (source domain mixing method) transfer learning method, DADRN-Combination, LSTM-DANN-Combination and TCN-DAL-Combination.

[0072] Multi-source domain (domain adaptation) transfer learning methods, CNN-MDAN, CoDATS and LSTM-MDANN.

[0073] 5. Comparison with Baseline Models Table 4 details the results of all methods obtained on the above two datasets. As can be seen from the table, AMDAN's F1 and AUC-ROC values ​​are the highest on all datasets, indicating that its overall performance is better than all compared methods. On the SMD dataset, it achieved an F1 value of 2.7% and a ROC value of 1.5% higher than the best baseline model, while on the WTD dataset, the advantage is even more obvious, achieving an F1 value of 1.6% and a ROC value of 8.1% higher than the best baseline model.

[0074] Among all the compared methods, the non-transfer multivariate time series method has the lowest overall performance, among which the lowest F1 of Transformer is only 0.6634, and the lowest ROC of GDN is only 0.5507, which is due to the insufficient number of training set samples. For multivariate time series, it is very necessary to effectively learn the complex temporal and spatial relationships between time series. When historical data is insufficient, not only can such relationships not be captured, but also overfitting of limited data may occur. Therefore, when the model is first fully trained using data from other devices and then fine-tuned using data from the target device, the detection performance can be improved even if the model structure is not improved. This can be seen from the experimental results of the pre-training-fine-tuning transfer learning method in the table. On the WTD dataset, the F1 of Transformer is improved to 0.7717, and the ROC value of GDN is also improved to 0.6457. Similarly, on the SMD dataset, the F1 of Transformer is improved to 0.6024. This embodiment adopts the input and feature extraction layer parameters of the non-migrating multivariate time series method in the fixed baseline model, and only performs parameter training on the output layer. From the results, it can be seen that the common features that cross between devices help to learn the representation of high-order features related to the task in the time series. After fine-tuning, the F1 and ROC-AUC values ​​of almost all methods have been improved, among which the Transformer-Finetuning method has the most obvious improvement in these two indicators, reaching 8.04% and 0.9% on the WTD dataset, and 29.55% and 1.44% on the SMD dataset. This is very meaningful for anomaly detection tasks, because it is hoped to obtain the highest possible Recall value to comprehensively detect potential anomalies in the data.

[0075] In addition, single-source domain transfer learning methods often perform better than non-transfer multivariate time series methods or pre-training-fine-tuning transfer learning methods. Among them, the ROC values ​​of DADRN and TCN-DAL on the WTD dataset are 10.9% and 6.1% higher than the best model distribution in the non-transfer multivariate time series methods. This also shows the effectiveness of transfer learning in anomaly detection tasks. Furthermore, the same model is used to verify the performance of the model under the condition of mixing multiple source domains. The experimental results show that only the effect of the LSTM-DANN model source domain mixing method is improved compared with the single-source domain transfer learning method under the WTD dataset, while the performance of DADRN and TCN-DAL is reduced after either source domain mixing or multi-source domain transfer training. This phenomenon is more obvious on the SMD dataset, and the performance of all models after source domain mixing has decreased. This is mainly because single-source domain migration only needs to consider the domain offset problem between two domains, while multi-source migration needs to consider the offset problem between multiple source domains at the same time. Since the data distribution between different devices is more complex, simply mixing these data cannot actually become an effective single-domain source data set. Not only can it not guarantee better performance of the model, it may even cause negative migration due to the differences in the distribution of data between different devices, thus affecting the effect of the model.

[0076] Although the source domain mixing method of the multi-source domain transfer learning method cannot bring the expected performance improvement, the latest CoDATS, LSTM-MDANN, and CNN-MDAN three multi-source domain adaptation transfer learning algorithms have shown excellent performance on both data sets, and the ROC values ​​are all over 0.9. This is because these methods are configured with aligned neural network layers of the source domain and the target domain. Although they use different methods (CoDATS is based on MMD alignment, while LSTM-MDANN and CNN-MDAN are based on adversarial network alignment), these aligned networks make the data feature spaces of the source domain and the target domain as close as possible, thereby reducing the probability of negative transfer. At the same time, the transferable knowledge contained in multiple source domains is usually more than that in a single source domain, which is beneficial to improving the anomaly detection performance of the model. However, the problem of negative transfer is always worthy of special attention, which is also the reason why the CNN-MDAN method in the multi-source domain transfer method has not achieved the same magnitude of performance improvement as the other two methods. Inspired by this, in this embodiment, the importance of different source domains is expressed by attention coefficients to guide the training of the model, and better performance than the baseline model is achieved, proving the effectiveness of the method.

[0077] Table 4 Performance comparison between AMDAN and baseline models

[0078] 6. Analysis of the impact of data capacity on performance Taking the WTD dataset as an example, the training data is cropped proportionally, and the performance change curves of different methods are plotted as the size of the target domain gradually increases. Figure 2 As shown in the figure, AMDAN still achieves a significant advantage in anomaly detection in small target domains. When the data volume is 5% or 10%, the performance of non-transfer deep learning algorithms is greatly affected, which may be due to the serious overfitting of the model to the small target domain. As the amount of data increases, the performance of the baseline model continues to improve until it stabilizes. Compared with these non-transfer deep learning algorithms, the transfer learning algorithm is relatively less affected by data. AMDAN, due to the strategy based on domain attention and multi-domain anomaly discrimination, still achieves performance that exceeds other models with 100% data volume when the data volume is only 5%. In summary, the performance of AMDAN under different numbers of target domains proves that it has universal and good transfer learning capabilities.

[0079] 7. Ablation Experiment In order to verify the effectiveness of multi-source domain migration, domain attention and multi-domain anomaly discrimination strategies in AMDAN, a series of ablation experiments were conducted. This embodiment uses "-multi-source domain", "-attention" and "-multi-domain anomaly discrimination" to represent the simplified AMDAN model after eliminating these strategies. For the "-multi-source domain" method, the alignment operation of the network on multiple source domains is removed, and only the alignment of a single source domain with the target domain is retained. For the "-attention" method, the original loss based on the attention coefficient is replaced with the average value of the loss on multiple source domains. In essence, it has degenerated into a network similar to the baseline model LSTM-MDANN, but the multi-domain anomaly discrimination strategy is still retained. For "-multi-domain anomaly discrimination", the predictions on the final multiple source domains are averaged to obtain a single prediction output, and the state score is calculated on a single prediction result to replace the original multi-domain anomaly discrimination strategy that is independent of the source domain prediction result. Figure 3 and Figure 4The anomaly detection results after eliminating these strategies on the SMD dataset and the WTD dataset are shown respectively. Overall, the three models showed significant performance loss on all datasets after eliminating the strategies. The performance drop after eliminating the multi-source domain migration strategy on the WTD dataset was the most obvious, reaching 8%, while on the SMD dataset, the performance drop after eliminating the multi-source domain migration was also 10.12%. This shows that multi-source domain migration can learn rich knowledge from different source domains and enable the network to achieve better results than single-source migration. Eliminating the domain attention strategy also has a significant impact on the model performance, which drops by 2% and 7.78% on the WTD dataset and SMD dataset, respectively, verifying the importance of adaptively assigning reasonable weights to different source domains according to their data distribution during the network learning process. In addition, after eliminating the multi-domain anomaly discrimination strategy, the performance of the model on two different datasets also dropped by 4% and 8.57%, respectively. In summary, these findings fully illustrate the significance of each improvement strategy and further verify the effectiveness and superiority of AMDAN.

[0080] 8. AMDAN domain alignment analysis In order to make the network perform well on the target device dataset, this embodiment attempts to extract features similar to the target domain from the source domain through an alignment operation based on domain attention. Therefore, in order to verify the effectiveness of this process, the distribution of the feature vectors after visualization of the original input and alignment is discussed. Since the eigenvalues ​​to be visualized have high dimensions, these high-dimensional features are first reduced in dimension through TSNE during the visualization process. Figure 5 The feature alignment effect between the target domain and three different source domains on the WTD dataset is shown. Figure 5 Middle (b) - Figure 5 (d) shows the distribution of the original input data of the target domain and each source domain. It can be clearly seen from the figure that there is a big difference between the two distributions. If the model is trained directly using these source domain data, it is bound to fail to achieve the desired effect on the target domain. Figure 5 Middle (e) - Figure 5 In the distribution diagram (g), the data has been aligned to the same distribution range, which helps the target domain obtain more useful information during the prediction process. Figure 5 Middle (e) - Figure 5 As can be seen from (g), the data distribution of the three source domains and target domains in this dataset is similar, so their attention coefficients are also relatively balanced. Figure 6 In the SMD dataset, the distribution of source domain and target domain features of device No. 1 before and after alignment is shown. This situation is quite different. Figure 6 Middle (b) - Figure 6From the distribution of the original data in (d), we can see that the source domain 2 is closer to the target domain in distribution, and its attention weight is larger. In summary, the domain alignment based on domain attention in AMDAN does not simply map the source domain and the target domain to the same feature space, but performs differentiated processing to reduce the probability of negative transfer. Figure 3 The results in show that this strategy is beneficial for improving the accuracy of anomaly detection.

[0081] This embodiment also provides a multivariate time series anomaly detection system, which adopts the following technical solution: comprising: a framework building module and a training module, wherein the framework building module and the training module are connected.

[0082] The framework building module is used to build an anomaly detection framework, wherein the anomaly detection framework includes a domain attention-based feature extractor, a domain attention-based feature predictor, and a multi-domain anomaly discriminator connected in sequence, wherein the domain attention-based feature extractor is based on a BiGRU network and includes multiple double-layer sub-networks; The training module is used to train the domain attention-based feature extractor and the domain attention-based feature predictor using multivariate time series data of the source domain and the target domain to obtain a multivariate time series anomaly detection model; the multivariate time series anomaly detection model is used to perform multivariate time series anomaly detection.

[0083] The multivariate time series data to be detected is input into the multivariate time series anomaly detection model, and the multivariate time series anomaly detection model outputs a final prediction result to obtain anomalies in the multivariate time series data to be detected.

[0084] This embodiment also provides a computer program product, including a computer program, which implements the above-mentioned multivariate time series anomaly detection method when executed by a processor.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multivariate time series anomaly detection method, characterized in that: include: Building an anomaly detection framework, the anomaly detection framework includes a domain attention-based feature extractor, a domain attention-based feature predictor, and a multi-domain anomaly discriminator connected in sequence, the domain attention-based feature extractor is based on a BiGRU network and includes multiple double-layer sub-networks; Using multivariate time series data of the source domain and the target domain to train the domain attention-based feature extractor and the domain attention-based feature predictor to obtain a multivariate time series anomaly detection model; The multivariate time series anomaly detection model is used to perform multivariate time series anomaly detection.

2. A multivariate time series anomaly detection method as claimed in claim 1, characterized in that: Each of the two-layer sub-networks corresponds to a source domain, and the two-layer sub-network includes a first sub-network and a second sub-network. The first sub-network is used to map multivariate time series data of different source domains to the same common space by sharing parameters; the second sub-network is used to receive common features from the first sub-network and extract features related to the corresponding source domain.

3. A multivariate time series anomaly detection method as claimed in claim 1 or 2, characterized in that: The domain attention-based feature extractor is trained by using the maximum mean difference to estimate the difference between the source domain and the target domain distribution, and the MMD loss based on domain attention The calculation formula is: in, Indicates The domain importance coefficient of the source domain, is the total number of source domains, represents the domain alignment loss, Indicates the input Multivariate time series data from source domains, represents the multivariate time series data of the input target domain, Indicates The mapping of the first subnetwork of the domain attention-based feature extractor to the source domains, Indicates The first sub-network parameters corresponding to the source domain, Indicates The mapping of the second sub-network of the domain attention-based feature extractor to the source domains, Indicates The second sub-network parameters corresponding to the source domain.

4. A multivariate time series anomaly detection method as claimed in claim 3, characterized in that: No. Domain importance coefficient of source domains The calculation formula is: in, represents the learnable weight matrix, represents the transpose of a matrix, represents a nonlinear activation function, Represents a splicing operation, Indicates The domain attention network weights of the source domain, Indicates The source domain output vector of the domain attention-based feature extractor corresponding to the source domain, Indicates The target domain output vector of the domain attention-based feature extractor corresponding to the source domain, Represents an exponential function with the natural constant e as the base.

5. A multivariate time series anomaly detection method as claimed in claim 1, characterized in that: The domain attention-based feature predictor adopts a multi-layer perceptron.

6. A multivariate time series anomaly detection method as claimed in claim 4, characterized in that: The domain attention-based feature predictor is trained on multiple source domains and optimized using the mean square error loss based on domain attention. The loss calculation formulas on the source domain and the target domain are: in, represents the loss corresponding to the source domain, represents the loss corresponding to the target domain, represents the mean square error loss, Indicates Domain attention-based feature predictors corresponding to source domains, Indicates The feature predictor parameters corresponding to the source domain, Indicates The true value of the source domain, Represents the true value of the target domain; Total loss The calculation formula is: in, A hyperparameter representing the balanced loss.

7. A multivariate time series anomaly detection method as claimed in claim 1, characterized in that: According to the prediction values ​​under different source domain supervision output by the domain attention-based feature predictor, the multi-domain anomaly discriminator calculates the final prediction result using the majority voting method.

8. A multivariate time series anomaly detection method as claimed in claim 7, characterized in that: The process of calculating the final prediction result by the multi-domain anomaly discriminator is as follows: According to the predicted values ​​under supervision of different source domains output by the domain attention-based feature predictor and the true observation values ​​corresponding to different source domains, the state score corresponding to each source domain is calculated. The formula for calculating the status score is: in, Indicates the status score, It means to find the maximum value, Indicates The predicted value of a variable, Indicates The actual observed value of the variable, Indicates The interquartile range of the predicted values ​​of the variables, express the median of represents the total number of variables; Determine the target value state of the corresponding source domain according to the state score. If the state score is greater than a threshold, the target value state is abnormal and marked as 1; otherwise, the target value state is normal and marked as 0; The target value states are combined using a majority voting method to obtain a final prediction result.

9. A multivariate time series anomaly detection system, characterized in that: The method for detecting anomalies in a multivariate time series according to any one of claims 1 to 8 comprises: a framework building module and a training module, wherein the framework building module is connected to the training module. The framework building module is used to build an anomaly detection framework, wherein the anomaly detection framework includes a domain attention-based feature extractor, a domain attention-based feature predictor, and a multi-domain anomaly discriminator connected in sequence, wherein the domain attention-based feature extractor is based on a BiGRU network and includes multiple double-layer sub-networks; The training module is used to train the domain attention-based feature extractor and the domain attention-based feature predictor using multivariate time series data of the source domain and the target domain to obtain a multivariate time series anomaly detection model; the multivariate time series anomaly detection model is used to perform multivariate time series anomaly detection.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, a multivariate time series anomaly detection method according to any one of claims 1 to 8 is implemented.

Images