Time series data anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a time series data anomaly detection method and device, electronic equipment and a storage medium. The method comprises the steps of predicting expected time series data of a second time period according to original time series data of a first time period; performing different feature detection based on the original time sequence data and the expected time sequence data in a second time period, wherein the first time period is smaller than the second time period; and outputting an exception type corresponding to the condition set according to the detected condition set of which different features meet the configuration. According to the method, the expected time sequence data of the later time is obtained through prediction by using the original time sequence data of the previous time, different feature detection is performed on the real time sequence data of the later time in combination with the expected time sequence data so as to improve the accuracy of anomaly detection, and finally, when it is judged that the detected different features meet a condition set configured by a user, the anomaly detection accuracy is improved. And outputting a corresponding exception type, thereby achieving the purpose of exception classification through the configured condition set, and enabling exception detection to have certain interpretability and practical significance.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for detecting anomalies in time series data. Background Art

[0002] At present, anomaly detection of time series data has been widely used in many fields such as water affairs, water conservancy, electricity, aviation and aerospace, and the Internet of Things. Through timely and accurate anomaly detection, asset losses and safety risks caused by failures can be reduced. However, these anomalies are often not accurately determined by the time series of a single variable, and require a joint determination of multiple variables. For example, the anomaly of an aircraft engine involves the joint determination of multiple variables such as temperature, speed, and pressure. For another example, the anomaly of a water pump involves the joint determination of multiple variables such as flow, liquid level, and conductivity.

[0003] However, existing time series data anomaly detection schemes suffer from poor accuracy and low interpretability. Summary of the invention

[0004] The purpose of the present application is to propose a time series data anomaly detection method, device, electronic device and storage medium to address the deficiencies of the above-mentioned prior art, and this purpose is achieved through the following technical solutions.

[0005] The first aspect of the present application provides a method for detecting anomalies in time series data, the method comprising:

[0006] Predicting expected time series data in a second time period according to original time series data in a first time period among the input original time series data;

[0007] Based on the original time series data in the input original time series data and the expected time series data, different feature detection is performed, and the first time series data is smaller than the second time series data;

[0008] According to the different features detected satisfying the configured condition set, the abnormality type corresponding to the condition set is output.

[0009] The second aspect of the present application provides a time series data anomaly detection device, the device comprising:

[0010] A prediction module, used to predict expected time series data in a second time period based on the original time series data in the first time period in the input original time series data;

[0011] a detection module, configured to perform different feature detection based on the original time series data in the second time period of the input original time series data and the expected time series data, wherein the first time period is smaller than the second time period;

[0012] The abnormality determination module is used to output the abnormality type corresponding to the condition set according to whether the different detected features meet the configured condition set.

[0013] The third aspect of the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described in the first aspect above.

[0014] The fourth aspect of the present application proposes a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the steps of the method described in the first aspect above.

[0015] Based on the time series data anomaly detection method and device described in the first and second aspects above, the present application has at least the following beneficial effects or advantages:

[0016] The expected time series data for the second time period is obtained by using the original time series data of the first time period to predict, and then different feature detection is performed on the real time series data of the second time period in combination with the expected time series data to achieve the description of different modes and improve the accuracy of anomaly detection. Finally, when it is determined that the different detected features meet the condition set configured by the user, the corresponding anomaly type is output, thereby achieving the purpose of anomaly classification through the configured condition set, making anomaly detection have certain interpretability and practical significance.

[0017] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 The present invention is a flow chart of an embodiment of a method for detecting anomalies in time series data according to an exemplary embodiment;

[0020] Figure 2 is a schematic diagram showing a cause-effect relationship between various variables according to an exemplary embodiment;

[0021] Figure 3 is a schematic diagram of a structure of a prediction model according to an exemplary embodiment;

[0022] Figure 4is a schematic diagram showing abnormal performance of multivariate time series data according to an exemplary embodiment;

[0023] Figure 5 is a schematic diagram of a framework of multivariate time series anomaly detection according to an exemplary embodiment;

[0024] Figure 6 1 is a schematic diagram showing the structure of a device for detecting abnormality in time series data according to an exemplary embodiment;

[0025] Figure 7 is a schematic diagram of a hardware structure of an electronic device according to an exemplary embodiment;

[0026] Figure 8 The figure is a schematic diagram of the structure of a storage medium according to an exemplary embodiment. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0029] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0030] As mentioned above, anomaly detection of time series data often involves the comprehensive determination of the time series of multiple variables rather than the determination of a single variable. It is understandable that multiple variables can be variables at multiple spatial locations, or multiple variables at one spatial location, or a combination of the two.

[0031] In the prior art prior to this application, some general multivariate time series anomaly detection aims to detect all anomalies of each variable, which is not what the user expects. In addition, for some complex disturbance scenarios, the accuracy is poor and some detected anomalies have no practical significance.

[0032] Therefore, existing multivariate time series anomaly detection schemes suffer from poor accuracy and low interpretability.

[0033] In view of this, the present application makes an improved design for these problems, by dividing anomaly detection into two parts: prediction and detection, and combining the two parts to improve the interpretability and accuracy of anomalies. That is, by using the original time series data of the first time period to predict the expected time series data of the second time period, and then combining the expected time series data, different feature detection is performed on the real time series data of the second time period to achieve the description of different modes and improve the accuracy of anomaly detection. Finally, when it is judged that the different detected features meet the condition set configured by the user, the corresponding anomaly type is output, so as to achieve the purpose of anomaly classification through the configured condition set, so that anomaly detection has certain interpretability and practical significance.

[0034] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0035] Figure 1 The following is a flow chart of an embodiment of a method for detecting anomalies in time series data according to an exemplary embodiment. The method for detecting anomalies in time series data includes the following steps:

[0036] Step 101: predict expected time series data in a second time period based on original time series data in a first time period in input original time series data.

[0037] Among them, the input original time series data is real data collected within a certain time range and arranged in time series. As mentioned above, anomaly detection is often a comprehensive judgment of multiple variables, so the original time series data can be time series data of multiple variables.

[0038] In the embodiment of the present application, the time range of the input original time series data is divided into two parts: a first time period and a second time period, the second time period is greater than the first time period, and the expected time series data of the second time period is predicted by using the original time series data of the first time period. The expected time series data indicates the expected output, that is, the expected output in the future is obtained based on the historical data prediction.

[0039] It should be noted that before predicting the expected time series data for the second time period, the time series data of each variable in the original time series data may be standardized and normalized to maintain the consistency of the time series data of each variable and improve the prediction accuracy.

[0040] In an optional embodiment, the causal relationship between variables in the original time series data can be obtained, and then the original time series data of the first time period and the causal relationship are input into a preset prediction model, and the expected time series data of the second time period is output through the prediction model based on the original time series data and the causal relationship of the first time period.

[0041] The causal relationship between variables indicates the influence relationship between them, that is, which variables affect a variable, and which variables the variable affects. Figure 2 The causal relationship diagram between the four variables shown in the figure shows that variable X3 is affected by variables X1 and X2, and variable X3 in turn affects variable X4. By inputting the causal relationship into the prediction model, the prediction model is guided to predict the expected output based on the influence relationship between the variables, thereby improving the accuracy of the prediction output.

[0042] In one embodiment, if Figure 3 The prediction model structure shown in the figure includes a feature extraction network, a concatenation layer, an encoder network, and a decoder network. The prediction process is as follows:

[0043] First, the feature extraction network extracts the time period features and the associated features of each variable based on the original time series data of the first time period and the causal relationship between each variable.

[0044] Specifically, the feature extraction network further includes a position encoding network and a graph attention network. The position encoding network is used to extract time period features based on the original time series data, and the graph attention network is used to extract the association features of each variable based on the original time series data and causal relationships.

[0045] Among them, the time series data involved in this embodiment contains certain periodic components, rather than chaotic time series data. The position encoding network can use position encoding to realize the extraction of time period features, and the output time period features can include the encoding vector and period encoding vector of the local window of the time series. The graph attention network can adopt the GAT (Graph Attention Networks) model architecture. GAT is a node-by-node calculation logic. It learns the influence of other nodes on this node by accessing the attention mechanism, and at the same time guides the attention mechanism to learn the influence between variable nodes in combination with the causal relationship between the variables, which has better robustness.

[0046] Then, the concatenation layer concatenates the time period features and the associated features of each variable to obtain the concatenated features.

[0047] Then, the encoder network encodes the concatenated features to obtain latent space features.

[0048] The encoder can use VAE (Variational Auto Encoder) of Transformer architecture to encode the input concatenated features to obtain latent space features. The latent space features include invariant part features and conditional variable part features. The invariant part features are the fixed and invariant parts of the multivariate time series under different conditions, and the conditional variable part features are the expected changing parts of the multivariate time series under different conditions.

[0049] Finally, the decoder network reconstructs the latent space features according to the concatenated features and outputs the expected time series data for the second time period.

[0050] In order to reduce the potential space features output by the encoder learning, the information of the original features is lost, and then the decoder is used to reconstruct and restore the input potential space features, and then output the expected time series data.

[0051] Based on the prediction logic of the prediction model described above, by extracting the time period features and the associated features of each variable respectively, and using the encoder and decoder of the Transformer architecture, the expected output of multi-variable time series is realized through the latent space. Compared with the use of the GRU (Gate Recurrent Unit) architecture to realize multi-variable time series prediction, it can avoid the problem of increased prediction error caused by long-term prediction.

[0052] It should be noted that, for the training process of the above prediction model, when calculating the loss, in addition to calculating the loss value of the predicted output value and the actual value, the learning of the latent space of the encoder-decoder can also be optimized, that is, the loss value of the before and after values ​​of the invariant part of the latent space features output by the encoder is calculated, and the posterior probability distribution of the conditional variable part of the latent space features under the input value is calculated. The probability distribution similarity loss can be calculated using the KL divergence formula.

[0053] Step 102: Perform different feature detection based on the original time series data in the second time period and the expected time series data in the second time period in the input original time series data.

[0054] Among them, by using the expected output and actual output in the same period of time to detect the different characteristics of the actual output, the performance of the real time series data is described in different modes, so as to facilitate the subsequent comprehensive analysis of various characteristic modes to determine abnormalities.

[0055] In an optional embodiment, residual data between the original time series data of the second time period and the expected time series data can be obtained, and then different feature detections can be performed based on the residual data and the original time series data of the second time period.

[0056] Among them, the residual data between the original time series data and the expected time series data can characterize the gap between the actual observed value and the expected value. By combining the residual data between the actual output and the expected output to detect different features of the actual output, the accuracy of feature detection can be improved.

[0057] It should be noted that after obtaining the residual data, the original time series data and the residual data can be transformed. The data changes include: in order to reduce the time misalignment problem between the time series of the original time series data and the time series of the residual data, the original time series data and the residual data can be resampled by time to align the time series of the original time series data with the time series of the residual data. At the same time, the peak and trough values ​​of the original time series data can also be extracted to facilitate feature detection.

[0058] In a specific implementation, for the detection process of different features, the correlation characteristics between each pair of associated variables contained in the causal relationship can be detected based on the causal relationship and residual data between the variables in the original time series data, so as to realize the detection of the influence relationship between the variables. The correlation characteristics represent the fluctuation correlation between the associated variables, for example, the fluctuation correlation is negatively correlated, positively correlated, etc. In specific implementation, cross-correlation or DTW (Dynamic Time Warping) can be used to calculate the correlation coefficient and offset value of the two associated variables to obtain the fluctuation correlation.

[0059] Alternatively, the change characteristics of a single variable may be detected based on the original time series data of the second time period. Optionally, the change characteristics of a single variable include any one or more combinations of characteristics of trend change, characteristics of whether a mutation occurs, and characteristics of periodic change. For example, trend changes are extracted using STL (Seasonal-Trend-Loss, seasonal trend loss) time series decomposition algorithms to obtain trend changes; mutation detection uses inflection point detection algorithms such as Bottom-up to obtain whether a mutation occurs; period detection uses Fourier transform or wavelet transform to extract the main period to obtain periodic changes.

[0060] It can be seen that the detected features can include correlation features between associated variables and change features of single variables, and these features are all interpretable.

[0061] In another specific implementation, for the detection process of different features, different feature detections can also be performed based on the configured condition set, residual data, and original time series data to reduce the number of feature detections and improve detection efficiency. Determine each condition included in the condition set, and when there is a correlation condition of an associated variable in each condition, detect the correlation characteristics of the associated variable in each condition based on the residual data; when there is a single variable condition in each condition, detect the change characteristics of the single variable in each condition based on the original time series data.

[0062] Step 103: According to whether the different detected features satisfy the configured condition set, the abnormality type corresponding to the condition set is output.

[0063] The condition set may be a combination of conditions that a certain type of anomaly should have based on a specific scenario configuration, which includes various conditions and logical relationships between the various conditions. Based on the feature detection described in step 102 above, the various conditions include correlation conditions and / or single variable conditions.

[0064] In this embodiment, multiple condition sets may be configured, each condition set corresponding to a type of anomaly, so that the output anomaly classification can be achieved.

[0065] For example, in the urban drainage scenario, there are different types of anomalies, such as abnormal water quality and quantity at the drainage pump station, mixed rainwater and sewage in the sewage network, pipe blockage, etc. These types of anomalies are caused by a combination of different abnormal conditions, such as Figure 4 As shown, it is a multivariate time series data display of water quality and quantity anomalies in drainage pumping stations. Figure 4 It can be seen that the time series data contains three variables, namely the time series data of the pump station liquid level, the time series data of the river liquid level and the time series data of the pump station water quality conductivity. The shaded part represents the abnormal characteristics of the three variables in the same time period. Therefore, the condition set for the abnormal water quality and water quantity of the drainage pump station is:

[0066] "The correlation between the pumping station liquid level and the river channel liquid level fluctuation is abnormal and positively correlated, and the correlation between the pumping station liquid level and the conductivity fluctuation is abnormal and negatively correlated, and the pumping station liquid level is on an upward trend."

[0067] It can be understood that in addition to the drainage scenarios listed above, the present application scheme can also be applied to scenarios such as agriculture, aviation, and scenarios involving abnormal rules including cycles, trends, mutations, and fluctuation correlations.

[0068] In an optional embodiment, the conditions included in the condition set and the logical relationship between the conditions can be determined, and then the target features matching the conditions can be determined among the different features. When it is determined that the target features meet the logical relationship between the conditions, it can be determined that the different features detected meet the configured condition set.

[0069] The accuracy of the anomaly detection process implemented in steps 101 to 103 above was verified. In the urban drainage scenario, 536 samples were divided, of which 6 were negative samples with abnormal water quality and quantity in the drainage pump station. By using the solution of the present application to perform anomaly detection on these 536 samples, 6 abnormal samples were actually detected, and an accuracy rate of 100 was obtained.

[0070] At this point, the above Figure 1 The anomaly detection process shown uses the original time series data of the first time period to predict the expected time series data of the second time period, and then combines the expected time series data to perform different feature detection on the real time series data of the second time period to achieve the description of different modes and improve the accuracy of anomaly detection. Finally, when it is determined that the different detected features meet the condition set configured by the user, the corresponding anomaly type is output, thereby achieving the purpose of anomaly classification through the configured condition set, making anomaly detection have certain explainability and practical significance.

[0071] Based on the above Figure 1 Based on the embodiment shown, Figure 5 This is a schematic diagram of a framework for multivariate time series anomaly detection according to an exemplary embodiment, which includes two parts: prediction and anomaly detection. In the prediction part, the input is the multivariate time series (i.e., original time series data) and the causal relationship of the multivariate, and the output is the expected time series of the multivariate, i.e., the expected time series data; in the anomaly detection part, the input is the residual data, the original time series data in the second time period, and the causal relationship between the variables, and the output is the detected anomaly type.

[0072] The specific implementation for the prediction part includes:

[0073] 1. Feature extraction: First, the original time series data is standardized and normalized, and then the time period feature extraction and the variable association feature extraction are performed on the original time series data in the first time period. Optionally, the time period feature is extracted based on the original time series data of the first time period using a position encoding network. The time period feature may include the encoding vector and period encoding vector of the local window of the time series. The variable association features are extracted based on the original time series data and causal relationships using a graph attention network. Specifically, the GAT (Graph Attention Networks) model architecture can be used to extract the variable association features, which is more robust.

[0074] 2. Encoder: The input is the concatenation of the time period feature and the associated features of each variable. The processing logic is to use the variational encoding idea of ​​VAE to convert the input concatenation feature from high-dimensional space to low-dimensional space representation, that is, the latent space feature. The latent space feature contains the invariant part feature and the conditional variable part feature. The invariant part feature is the fixed and invariant part of the multivariate time series under different conditions, and the conditional variable part feature is the expected change part of the multivariate time series under different conditions.

[0075] 3. Decoder: The decoder reconstructs the input latent space features to high-dimensional space based on the splicing features to obtain the expected time series data.

[0076] The specific implementation of the anomaly detection part includes:

[0077] First, when the detection is triggered based on the configured periodic detection task, the input original time series data and residual data are transformed, and various detection algorithms are used to detect different features. In terms of fluctuation correlation detection, the correlation characteristics between each pair of associated variables contained in the causal relationship are detected based on the causal relationship and residual data between the variables, such as detecting the correlation characteristics of the associated variables X1 and X2. In terms of single variable detection, the original time series data of each variable is used to detect its own change characteristics, such as trend change detection, mutation detection, periodic change detection, etc.

[0078] Then, according to the pre-configured condition set, it is determined whether the different detected features meet the conditions contained in the condition set and the logical relationship between the conditions. If they meet, the anomaly type corresponding to the condition set is output, thereby completing anomaly detection.

[0079] The execution subject of the embodiment of the present application may be an application, service, instance, software-based functional module, virtual machine (VM), container or cloud server, etc., or a hardware device (such as a server or terminal device) or hardware chip (such as CPU, GPU, FPGA, NPU, AI acceleration card or DPU) with data processing function. The device for realizing time series data anomaly detection can be deployed on the computing device of the application party providing the corresponding service or on the cloud computing platform providing computing power, storage and network resources. The mode of providing services to the outside world by the cloud computing platform may be IaaS (Infrastructure as a Service), PaaS (Platform as a Service), SaaS (Software as a Service) or DaaS (Data as a Service). Taking the platform providing SaaS software as a service (Software as a Service) as an example, the cloud computing platform can use its own computing resources to provide the training of the time series data anomaly detection model or the functional execution of the time series data anomaly detection module, and the specific application architecture can be built according to the service requirements. For example, the platform can provide construction services based on the above model to application parties or individuals using platform resources, and further call the above model and implement online or offline time series data anomaly detection functions based on time series data anomaly detection requests submitted by related clients or servers and other devices.

[0080] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0081] Corresponding to the above-mentioned embodiment of the time series data anomaly detection method, the present application also provides an embodiment of the time series data anomaly detection device.

[0082] Figure 6 FIG. 1 is a schematic diagram of a time series data anomaly detection device according to an exemplary embodiment. The device is used to execute the time series data anomaly detection method provided in any of the above embodiments. Figure 6 As shown, the time series data anomaly detection device includes:

[0083] A prediction module 610, configured to predict expected time series data in a second time period according to original time series data in a first time period in the input original time series data;

[0084] A detection module 620, configured to perform different feature detection based on the original time series data in the second time period of the input original time series data and the expected time series data, wherein the second time period is greater than the first time period;

[0085] The abnormality determination module 630 is used to output an abnormality type corresponding to the condition set according to whether the different detected features meet the configured condition set.

[0086] In one possible implementation, the prediction module 610 is specifically used to obtain the causal relationship between the variables in the original time series data; input the original time series data of the first time period and the causal relationship into a preset prediction model; and output the expected time series data of the second time period based on the original time series data of the first time period and the causal relationship through the prediction model.

[0087] In one possible implementation, the prediction model includes a feature extraction network, a splicing layer, an encoder network and a decoder network; the prediction module 610 is specifically used to extract time period features and variable association features according to the original time series data of the first time period and the causal relationship between each variable through the feature extraction network in the process of outputting the expected time series data of the second time period through the prediction model according to the original time series data of the first time period and the causal relationship; splicing the time period features and the variable association features through the splicing layer to obtain splicing features; encoding and transforming the splicing features through the encoder network to obtain latent space features; reconstructing the latent space features through the decoder network according to the splicing features, and outputting the expected time series data of the second time period.

[0088] In one possible implementation, the feature extraction network includes a position encoding network and a graph attention network; the prediction module 610 is specifically used to extract the time period features and the associated features of each variable based on the original time series data of the first time period and the causal relationship between each variable through the feature extraction network, and to extract the associated features of each variable based on the original time series data and the causal relationship through the graph attention network.

[0089] In a possible implementation, the detection module 620 is specifically used to obtain residual data between the original time series data of the second time period and the expected time series data; and perform different feature detections based on the residual data and the original time series data of the second time period.

[0090] In one possible implementation, the detection module 620 is specifically used to detect the correlation characteristics between each pair of associated variables included in the causal relationship based on the causal relationship between each variable in the original time series data and the residual data during the process of performing different feature detections based on the residual data and the original time series data of the second time period; and / or, detect the change characteristics of a single variable based on the original time series data of the second time period.

[0091] In a possible implementation, the change characteristics of the single variable include any one or more combinations of characteristics of trend change, characteristics of whether a sudden change occurs, and characteristics of periodic change.

[0092] In one possible implementation, the anomaly determination module 630 is specifically used to determine the conditions included in the condition set and the logical relationship between the conditions; determine the target feature that matches the conditions among the different features; the conditions include correlation conditions and / or single variable conditions; and when the target feature meets the logical relationship between the conditions, determine that the different features detected meet the configured condition set.

[0093] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0094] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0095] The embodiment of the present application also provides an electronic device corresponding to the time series data anomaly detection method provided in the above embodiment, so as to execute the above time series data anomaly detection method.

[0096] Figure 7The hardware structure diagram of an electronic device according to an exemplary embodiment is shown, and the electronic device includes: a communication interface 601, a processor 602, a memory 603 and a bus 604; wherein the communication interface 601, the processor 602 and the memory 603 complete mutual communication through the bus 604. The processor 602 can execute the time series data anomaly detection method described above by reading and executing the machine executable instructions corresponding to the control logic of the time series data anomaly detection method in the memory 603. The specific content of the method is referred to the above embodiment, and will not be repeated here.

[0097] The memory 603 mentioned in this application can be any electronic, magnetic, optical or other physical storage device, and can contain storage information, such as executable instructions, data, etc. Specifically, the memory 603 can be RAM (Random Access Memory), flash memory, storage drive (such as hard disk drive), any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 601 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used.

[0098] The bus 604 may be an ISA bus, a PCI bus or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 603 is used to store programs, and the processor 602 executes the programs after receiving execution instructions.

[0099] Processor 602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in processor 602 or an instruction in software form. The above-mentioned processor 602 can be a general-purpose processor, including a network processor (Network Processor, referred to as NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor to execute, or the hardware and software modules in the decoding processor are combined to execute.

[0100] The electronic device provided in the embodiment of the present application and the time series data anomaly detection method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0101] The present application also provides a computer-readable storage medium corresponding to the time series data anomaly detection method provided in the above embodiment. Figure 8 As shown, the computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the method for detecting anomalies in time series data provided by any of the aforementioned embodiments will be executed.

[0102] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0103] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the time series data anomaly detection method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0104] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0105] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0106] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A time series data anomaly detection method, characterized in that: The method comprises: According to the original time series data in the first time period of the input original time series data, the expected time series data in the second time period is predicted; the first time period is shorter than the second time period Perform different feature detection based on the original time series data in the second time period and the expected time series data in the input original time series data; According to the different features detected satisfying the configured condition set, the abnormality type corresponding to the condition set is output.

2. The method according to claim 1, characterized in that: The predicting expected time series data in a second time period according to the original time series data in the first time period in the input original time series data includes: Obtaining the causal relationship between the variables in the original time series data; Inputting the original time series data of the first time period and the causal relationship into a preset prediction model; The prediction model outputs expected time series data for a second time period according to the original time series data for the first time period and the causal relationship.

3. The method according to claim 2, characterized in that The prediction model includes a feature extraction network, a concatenation layer, an encoder network and a decoder network; Outputting expected time series data for a second time period according to the original time series data for the first time period and the causal relationship through the prediction model includes: Extracting time period features and associated features of each variable based on the original time series data of the first time period and the causal relationship between each variable through the feature extraction network; The time period feature and the associated features of each variable are spliced ​​through the splicing layer to obtain a splicing feature; Performing encoding transformation on the splicing features through the encoder network to obtain latent space features; The latent space features are reconstructed according to the splicing features by the decoder network, and expected time series data for a second time period is output.

4. The method according to claim 3, characterized in that The feature extraction network includes a position encoding network and a graph attention network; Extracting time period features and variable association features according to the original time series data of the first time period and the causal relationship between the variables through the feature extraction network includes: Extracting time period features based on the original time series data through the position encoding network; The graph attention network is used to extract the associated features of each variable based on the original time series data and the causal relationship.

5. The method according to claim 1, characterized in that Based on the original time series data in the second time period in the input original time series data and the expected time series data, different feature detections are performed, including: Obtaining residual data between the original time series data of the second time period and the expected time series data; Different feature detection is performed based on the residual data and the original time series data of the second time period.

6. The method according to claim 5, characterized in that The performing different feature detection according to the residual data and the original time series data of the second time period includes: According to the causal relationship between the variables in the original time series data and the residual data, detecting the correlation characteristics between the pairs of associated variables included in the causal relationship; and / or, The change characteristics of the single variable are detected based on the original time series data of the second time period.

7. The method according to claim 6, characterized in that The change characteristics of the single variable include any one or more combinations of the characteristics of trend change, the characteristics of whether a mutation occurs, and the characteristics of periodic change.

8. The method according to any one of claims 1 to 7, characterized in that: The set of conditions that meet the configuration according to the different features detected includes: Determine the conditions included in the condition set and the logical relationship between the conditions; Determining a target feature matching each of the conditions among the different features; each of the conditions includes a correlation condition and / or a univariate condition; In the case where the target feature meets the logical relationship between the conditions, it is determined that the different features detected meet the configured condition set.

9. A time series data anomaly detection device, characterized in that: The device comprises: A prediction module, used to predict expected time series data in a second time period based on the original time series data in the first time period in the input original time series data; a detection module, configured to perform different feature detection based on the original time series data in the second time period of the input original time series data and the expected time series data, wherein the first time period is smaller than the second time period; The abnormality determination module is used to output the abnormality type corresponding to the condition set according to whether the different detected features meet the configured condition set.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: The processor executes the program to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the steps of the method according to any one of claims 1 to 8.

Images