Sequence detection method and device, equipment, storage medium and product

Abstract

The invention discloses a sequence detection method and device, equipment, a storage medium and a product. The method comprises the following steps: performing data shielding in a first time sequence by adopting a preset data shielding strategy to obtain a second time sequence; diffusion processing and reverse processing are sequentially carried out on the second time sequence, a purified third time sequence is obtained, and the third time sequence is a time sequence not containing pollution data; obtaining a dependency relationship among data variables in the third time sequence by using a graph learning strategy and a graph neural network; according to the dependency relationship, performing data reconstruction on the third time sequence to obtain a fourth time sequence; calculating by using the first time sequence, the second time sequence and the fourth time sequence to obtain an abnormal score of each data value in the first time sequence; and performing anomaly detection on each data value according to the anomaly score to obtain an abnormal data value. According to the embodiment of the invention, the accuracy of time sequence anomaly detection is improved.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a sequence detection method, device, equipment, storage medium and product. Background Art

[0002] In the field of IT operation and maintenance, timely detection of system anomalies is crucial. The ability to identify and describe abnormal patterns and behaviors can help improve service quality and operational efficiency. Time series anomaly detection is a key challenge in the telecommunications field. With the development of China Mobile's business support system, the system has become more complex, and the need for time series data anomaly detection has become increasingly important.

[0003] Time series anomaly detection is divided into unsupervised anomaly detection and supervised anomaly detection. Unsupervised anomaly detection does not require pre-labeled anomaly samples as training data, but identifies anomalies by analyzing patterns and statistical properties in the data; supervised anomaly detection uses labeled training data to train the model and uses the model to predict outliers in unlabeled data.

[0004] In centralized systems, researchers have found that whether it is unsupervised or supervised time series anomaly detection, there will inevitably be problems with contaminated training data. Contamination can come from the mixing of a small amount of abnormal data or human labeling errors, which will directly affect the accuracy of time series anomaly detection results. Summary of the invention

[0005] The embodiments of the present application provide a sequence detection method, apparatus, device, storage medium and product to solve the problem of inaccurate time series anomaly detection.

[0006] In a first aspect, an embodiment of the present application provides a sequence detection method, the method comprising:

[0007] Using a preset data shielding strategy to perform data shielding in a first time series to obtain a second time series, wherein the first time series is a time series containing contaminated data;

[0008] performing diffusion processing and inverse processing on the second time series in sequence to obtain a purified third time series, wherein the third time series is a time series that does not contain polluted data;

[0009] Using a graph learning strategy and a graph neural network, obtaining dependencies between data variables in the third time series;

[0010] Reconstructing data of the third time series according to the dependency relationship to obtain a fourth time series;

[0011] Calculating using the first time series, the second time series, the third time series, and the fourth time series to obtain an abnormality score for each data value in the first time series;

[0012] According to the anomaly score, anomaly detection is performed on each data value to obtain an abnormal data value.

[0013] In a second aspect, an embodiment of the present application provides a sequence detection device, the device comprising:

[0014] A shielding module, used for shielding data in a first time series by using a preset data shielding strategy to obtain a second time series, wherein the first time series is a time series containing contaminated data;

[0015] a purification module, used for sequentially performing diffusion processing and reverse processing on the second time series to obtain a purified third time series, wherein the third time series is a time series that does not contain polluted data;

[0016] An acquisition module, used to acquire the dependency relationship between the data variables in the third time series by using a graph learning strategy and a graph neural network;

[0017] A reconstruction module, used for reconstructing data of the third time series according to the dependency relationship to obtain a fourth time series;

[0018] a calculation module, configured to perform calculation using the first time series, the second time series, the third time series, and the fourth time series to obtain an abnormality score for each data value in the first time series;

[0019] The detection module is used to perform anomaly detection on each data value according to the anomaly score to obtain an abnormal data value.

[0020] In a third aspect, an embodiment of the present application provides a terminal device, the device comprising: a processor and a memory storing computer program instructions;

[0021] When the processor executes the computer program instructions, the sequence detection method of the first aspect is implemented.

[0022] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the sequence detection method of the first aspect is implemented.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the sequence detection method of the first aspect.

[0024] The sequence detection method provided in the embodiment of the present application first adopts a preset data shielding strategy to specifically eliminate bad data in the first time series (including contaminated data) to generate a relatively pure second time series, which effectively reduces the complexity and error source of subsequent processing. Subsequently, by performing diffusion processing and reverse processing on the second time series, potential data noise and outliers are further eliminated, and the purified third time series is obtained, ensuring a substantial improvement in data quality. On this basis, the complex dependencies between data variables in the third time series are mined using graph learning strategies and graph neural network technology, and then data is reconstructed based on these dependencies to generate a fourth time series that further improves the accuracy and consistency of the data while maintaining the characteristics of the original data. Finally, by using the association between the first, second, third and fourth time series, the abnormal score of each data value is calculated to achieve accurate identification of abnormal data values ​​in the original time series. Not only does it make full use of the complementary information advantages of each time series, but it also significantly improves the accuracy and reliability of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0026] Figure 1 It is a flow chart of the sequence detection method provided in the embodiment of the present application;

[0027] Figure 2 is a structural schematic diagram of a sequence detection device provided in an embodiment of the present application;

[0028] Figure 3 It is a structural diagram of the terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0030] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0031] In order to solve the problems of the prior art, the embodiments of the present application provide a sequence detection method, apparatus, device, storage medium and product.

[0032] The following first introduces the sequence detection method provided in the embodiments of the present application.

[0033] Figure 1 FIG. 1 is a flow chart of a sequence detection method provided by an embodiment of the present application. Figure 1 As shown, the method includes:

[0034] Step 101, using a preset data shielding strategy to perform data shielding in a first time series to obtain a second time series, wherein the first time series is a time series containing contaminated data;

[0035] In this embodiment, the first time series is the sequence to be detected, which refers to the time series containing polluted data, and the pollution may come from the mixing of a small amount of abnormal data or misjudgment of artificial marking. The purpose of adopting the data shielding strategy is to shield the data in the first time series according to the proportion and reduce the proportion of abnormal data.

[0036] The first time series includes multiple sets of data values ​​corresponding to multiple first time stamps, each set of data values ​​is collected through multiple variables. Specifically, the data set is defined as X=(x (1) ,x (2) ,...,x (N) ), where the first time series Represented as the i-th data value in a time series of N data values, x (i) ∈R K×L, K and L are the number of variables and the length of the i-th data value, respectively. A data collection can be defined as L samples collected from K variables in the i-th time interval. As an example, for China Mobile's business support system, the variables can be indicators of each layer of SaaS / PaaS / IaaS, such as the business volume, time consumption and success rate indicators of the business layer, or the host CPU usage, memory usage, etc. of the infrastructure layer.

[0037] In one embodiment, the step of using a preset data masking strategy to mask data in the first time series to obtain a second time series includes:

[0038] In each of the plurality of first time stamps, a binary mask is used to randomly mask the data value corresponding to the variable to obtain a second time series; or

[0039] Dividing the first time series into a plurality of data segments, and using a binary mask to randomly mask any data segment in the plurality of data segments to obtain a second time series; or

[0040] In each of the multiple first timestamps, a binary mask is used to mask a data value corresponding to any first timestamp in the multiple first timestamps to obtain a second time series.

[0041] In this embodiment, in general, the number of normal samples will be significantly greater than the number of abnormal events. When a portion of the data in the first time series is shielded, it is possible to delete both normal and abnormal patterns. However, since the first time series mainly contains normal data, shielding some normal data has little effect, and the remaining large amount of normal data can still fully compensate for the shielded portion. On the contrary, the shielding strategy can effectively reduce the abnormal proportion.

[0042] The data masking strategy includes three masking scenarios, namely random masking (RandM), random block masking (RandBM) and power outage masking (BoM). Those skilled in the art can select a masking strategy for data masking as needed. The masking process is described below:

[0043] First, define a binary mask as v∈{0,1},v∈R K×L , where 0 represents the value to be masked and 1 represents the value to be retained. Therefore, the i-th masked observation is in ⊙ represents point-by-point multiplication.

[0044] In Random Masking (RandM), the variables to be masked are randomly selected and a hyperparameter r is assigned to each first timestamp, indicating the number of variables to be randomly selected and masked within each first timestamp. Here, the role of the binary mask v is to set the corresponding 0 and 1 values ​​according to the randomly selected variables and timestamps to determine which variables should be masked.

[0045] In Random Block Masking (RandBM), the data is divided into non-overlapping segments, each of size r. Then, a segment is randomly selected and all variables within the segment are masked. In this scenario, the setting of the binary mask v is also based on the random selection of the segment, and the mask values ​​corresponding to all variables within the selected segment are set to 0.

[0046] In the Blackout Mask (BoM), select the same segment to be masked across all variables. This method is suitable for scenarios where multiple variables need to be masked at the same time. In this scenario, the setting of the binary mask v can select a continuous segment of timestamps or variables and set their corresponding mask values ​​to all 0.

[0047] In this embodiment, three data masking strategies can be used to simulate different levels and degrees of data contamination or missing conditions, thereby enhancing the adaptability and robustness of the model to complex data environments. At the same time, this data enhancement method helps to improve the accuracy and generalization ability of subsequent anomaly detection.

[0048] Step 102, performing diffusion processing and inverse processing on the second time series in sequence to obtain a purified third time series, wherein the third time series is a time series that does not contain polluted data;

[0049] In this embodiment, a pre-built decontaminant module can be used for diffusion processing and reverse processing. The decontaminant uses two layers of S4, and the S4 layer is developed based on the diffusion model. The diffusion model is a type of generative model inspired by non-equilibrium thermodynamics, including two process paradigms: diffusion process and reverse process. Diffusion processing is used to perform diffusion processing on the second time series to reduce the volatility of the data. Reverse processing is used to perform reverse operations on the data after diffusion processing to restore the original characteristics of the data, while eliminating potential outliers, and obtaining a third time series that does not contain contaminated data.

[0050] Step 103, using a graph learning strategy and a graph neural network to obtain the dependency relationship between the data variables in the third time series;

[0051] Step 104, reconstructing the data of the third time series according to the dependency relationship to obtain a fourth time series;

[0052] In this embodiment, the pre-built variable dependency modeling module can be used to obtain the dependencies between data variables. A time-graph framework is constructed by capturing the intra-variable dependencies through multiple back-to-back S4 layers, dynamically learning the graph structure and features through the graph learning strategy, and capturing the inter-variable dependencies through the GIN layer.

[0053] Step 105, performing calculations using the first time series, the second time series, the third time series, and the fourth time series to obtain an abnormality score for each data value in the first time series;

[0054] In one embodiment, the calculating using the first time series, the second time series, the third time series, and the fourth time series to obtain an abnormality score for each data value in the first time series includes:

[0055] Calculate a first score using the first time series, the second time series, and a first formula;

[0056] Calculate a second score using the third time series, the fourth time series and the second formula;

[0057] The anomaly score is obtained according to the first score and the second score.

[0058] In this embodiment,

[0059] The first formula is:

[0060]

[0061] The second formula is:

[0062]

[0063] The third formula is:

[0064] s=λ1s1+λ2s2

[0065] Among them, x (i) is the first time series, is the second time series, M is the masking matrix, K is the number of variables, L is the length of the data value, is the fourth time series, S1 is the first score, S2 is the second score, S is the anomaly score, λ1 is the preset first hyperparameter, and λ2 is the preset second hyperparameter.

[0066] Step 106: Perform anomaly detection on each data value according to the anomaly score to obtain an abnormal data value.

[0067] In one embodiment, performing anomaly detection on each data value according to the anomaly score to obtain an abnormal data value includes:

[0068] In the case where the abnormality score is greater than a preset score threshold, the abnormality score is determined as the abnormal data value.

[0069] In this embodiment, the score threshold is determined using a pre-set validation set. When training the sequence detection model, the score threshold is determined using the sequence detection model and the validation set. Specifically, the validation set includes a validation set of normal and abnormal data values. First, for each data value in the validation set, its abnormality score s is calculated using the trained sequence detection model. This score reflects the degree to which the data value deviates from the normal state. Then, different τ values ​​are tried on the validation set, and the F1 score corresponding to each τ value is calculated. This process is usually achieved by traversing a reasonable range of τ values. Finally, the τ value that gives the highest F1 score is selected as the optimal decision threshold, i.e., the score threshold.

[0070] It should be noted that the above-mentioned sequence detection model refers to the model to which the sequence detection method of the present invention is applied.

[0071] In this embodiment, a preset data shielding strategy is firstly adopted to specifically remove bad data in the first time series (including contaminated data) to generate a relatively pure second time series, which effectively reduces the complexity and error sources of subsequent processing. Subsequently, by performing diffusion processing and reverse processing on the second time series, potential data noise and outliers are further eliminated, and a purified third time series is obtained, ensuring a substantial improvement in data quality. On this basis, the graph learning strategy and graph neural network technology are used to mine the complex dependencies between data variables in the third time series, and then the data is reconstructed according to these dependencies. The generated fourth time series further improves the accuracy and consistency of the data while maintaining the characteristics of the original data. Finally, by using the association between the first, second, third and fourth time series, the abnormal score of each data value is calculated to achieve accurate identification of abnormal data values ​​in the original time series. Not only does it make full use of the complementary information advantages of each time series, but it also significantly improves the accuracy and reliability of anomaly detection.

[0072] In an embodiment of the present application, the step of sequentially performing diffusion processing and inverse processing on the second time series to obtain a purified third time series includes:

[0073] In a plurality of diffusion steps, starting from the first diffusion step and ending at the last diffusion step, Gaussian noise is sequentially added to the second time series to obtain a fifth time series;

[0074] In a plurality of reverse steps, starting from a first reverse step and ending at a last reverse step, the first noise is removed from the fifth time series in sequence to obtain the third time series. The first noise is determined by a pre-acquired network approximator, and the reverse step is the same in number as the diffusion step and in the opposite direction.

[0075] In this embodiment, the purpose of diffusion processing is to "blur" the second time series data by adding noise, and this blurring process helps to remove unnecessary noise in subsequent steps. Specifically, Gaussian noise can be added to the second time series in sequence within multiple diffusion steps, starting from the first diffusion step and ending at the last diffusion step. Among them, Gaussian noise is a common type of noise, and its distribution conforms to Gaussian distribution, with a certain mean and variance.

[0076] The purpose of the inverse processing is to remove the additional noise introduced in the diffusion processing while retaining the useful information in the fifth time series as much as possible. Specifically, within a plurality of inverse steps, starting from the first inverse step and ending at the last inverse step, the first noise is removed from the fifth time series in sequence. The first noise is determined by a pre-acquired network approximator, which is trained based on machine learning or deep learning technology and can predict or estimate the noise introduced in the diffusion processing.

[0077] Specifically, in one embodiment, within the plurality of diffusion steps, starting from the first diffusion step and ending at the last diffusion step, Gaussian noise is sequentially added to the second time series to obtain a fifth time series, including:

[0078] For any diffusion step length among the multiple diffusion step lengths, a variance scheduling parameter of the arbitrary diffusion step length, a previous time series of the arbitrary diffusion step length, and a unit matrix are used to perform calculation to obtain a first normal distribution of the arbitrary diffusion step length;

[0079] Sampling from the first normal distribution to obtain Gaussian noise;

[0080] adding the Gaussian noise to the second time series;

[0081] In a case where the arbitrary diffusion step length is the last diffusion step length among the plurality of diffusion step lengths, the second time series to which Gaussian noise is added is determined as the fifth time series.

[0082] In this embodiment, the diffusion process is defined by a Markov chain. In T diffusion steps, in the second time series Initial stage Gaussian noise is added incrementally, and the diffusion process can be expressed as:

[0083] in

[0084] From the mean and variance is sampled from the first normal distribution of . I is the identity matrix, β t ∈(0,1) is a variance scheduling parameter that controls the amount of noise added in the nth step of diffusion. t Increase linearly from 0.0001 to 0.02.

[0085] Let α t =1-β t , The diffusion process can be based on β t Will Convert to a noisy fifth time series Expressed as The noise ε t ~N(0,I),ε t ∈R K×L Here Noise is added to both the shielded and unshielded parts of the gradually loses its distinguishable features and approaches a Gaussian distribution, whereby normal and abnormal patterns become indistinguishable.

[0086] In one embodiment, within the plurality of reverse steps, starting from the first reverse step and ending at the last reverse step, sequentially removing the first noise from the fifth time series to obtain the third time series includes:

[0087] For any reverse step length among the plurality of reverse step lengths, predicting a first noise in the any reverse step length using a network approximator;

[0088] Calculating the mean and variance corresponding to the arbitrary reverse step length using the first noise;

[0089] Sampling in a second normal distribution to obtain a sixth time series of the arbitrary reverse step length, wherein the second normal distribution is determined by the mean and variance;

[0090] In a case where the arbitrary reverse step is the last reverse step among the plurality of reverse steps, the sixth time series is determined as the third time series.

[0091] In this embodiment, for each reverse step size i (decreasing from T to 1), the network approximator is first used to predict the noise, that is, the network approximator based on S4 is used to predict the first noise of the current step size. Then the predicted first noise and the parameters in the diffusion process are used to calculate the mean μ of the reverse process. θ and variance σ θ The second normal distribution is then determined by the mean and variance, and sampling is performed from the second normal distribution to obtain the sixth time series with the reverse step length of the current one.

[0092] The overall description of the reverse process is as follows:

[0093] The inverse process defined by the Markov chain is parameterized by θ and can be expressed as:

[0094]

[0095] in μ θ and σ θ Parameterized as: in ε θ is a network approximator, with The diffusion step size t and the conditioning factor c are used as input to predict The noise in the The concatenation of the non-shielded segment in and the position information of the shielded part provided by v makes it easier for the reverse process to distinguish the zero part of the non-shielded part and the shielded part.

[0096] In this embodiment, the second time series is effectively purified through multiple diffusion steps and reverse steps. In the diffusion processing stage, the gradual addition of Gaussian noise helps to blur the redundant information and noise in the original data, laying a good foundation for subsequent data processing. In the reverse processing stage, the pre-acquired network approximator is used to accurately estimate and remove the first noise introduced in the diffusion process. This process not only removes unnecessary noise, but also retains the useful information in the original data to the maximum extent. Through these two stages of processing, this method can significantly improve the accuracy and reliability of time series data, and provide high-quality input for subsequent data analysis and anomaly detection.

[0097] In an embodiment of the present application, the method of using a graph learning strategy and a graph neural network to obtain the dependency relationship between the data variables in the third time series includes:

[0098] Projecting the third time series into an embedding space to obtain embedding space data;

[0099] Performing graph learning using the embedding space data to obtain a graph set, each graph in the graph set including an embedding matrix and an adjacency matrix;

[0100] Each of the graphs is processed using a graph neural network to determine a node embedding of each of the graphs, wherein the node embedding includes dependencies between the data variables.

[0101] In this embodiment, in the first step, the graph learning strategy dynamically learns the graph structure and features. For the S4 layer, use As input, where K is the number of variables and L is the length of the time series; then, it is projected into the embedding space H (i) ∈R K×Γ×U where Γ and U are hyperparameters defining the dimensionality of the S4 embedding. Γ is set to L to correspond to the length of the input time series. This enables modeling of long-term variable dependencies within each variable. (i) is used as input to the graph learning phase, which models the latent inter-variable dependencies.

[0102] For the graph learning stage, H (i) Represented as a set of graphs in g is a predefined length of short, non-overlapping time intervals within the i-th observation.

[0103] definition in Indicates H (i) The embedding matrix obtained by averaging the second dimension elements of Represents the adjacency matrix. Each row and column in corresponds to a node (i.e., variable).

[0104] Use graph neural network to process each graph. Node embedding is represented as Then all the nodes of the graph are embedded and connected as

[0105]

[0106] In addition, in step 104, when reconstructing the data, a linear layer can be added to obtain the reconstructed data

[0107] In this embodiment, the third time series data is processed using a graph learning strategy and a graph neural network, which can efficiently mine the complex dependencies between data variables. By projecting the time series data into the embedding space, not only the data dimension is reduced, but also the key features of the data are retained, providing a basis for subsequent graph learning. In the graph learning stage, a set of graphs is generated, each of which accurately describes the connection strength and pattern between data variables through an embedding matrix and an adjacency matrix. Further processing these graphs using a graph neural network can deeply learn and capture the node embeddings of the graphs, which essentially contain the deep dependencies between data variables. Improve the accuracy and efficiency of time series data analysis.

[0108] like Figure 2 As shown, the embodiment of the present application further provides a sequence detection device 200, the device comprising:

[0109] A shielding module 201 is used to use a preset data shielding strategy to perform data shielding in a first time series to obtain a second time series, where the first time series is a time series containing contaminated data;

[0110] A purification module 202, configured to sequentially perform diffusion processing and inverse processing on the second time series to obtain a purified third time series, wherein the third time series is a time series that does not contain polluted data;

[0111] An acquisition module 203 is used to acquire the dependency relationship between the data variables in the third time series by using a graph learning strategy and a graph neural network;

[0112] A reconstruction module 204, configured to reconstruct data of the third time series according to the dependency relationship to obtain a fourth time series;

[0113] A calculation module 205, configured to perform calculation using the first time series, the second time series, the third time series, and the fourth time series to obtain an abnormality score for each data value in the first time series;

[0114] The detection module 206 is used to perform anomaly detection on each data value according to the anomaly score to obtain an abnormal data value.

[0115] Optionally, the shielding module 201 is specifically used for:

[0116] In each of the plurality of first time stamps, a binary mask is used to randomly mask the data value corresponding to the variable to obtain a second time series; or

[0117] Dividing the first time series into a plurality of data segments, and using a binary mask to randomly mask any data segment in the plurality of data segments to obtain a second time series; or

[0118] In each of the multiple first timestamps, a binary mask is used to mask a data value corresponding to any first timestamp in the multiple first timestamps to obtain a second time series.

[0119] Optionally, the purification module 202 includes:

[0120] An adding submodule is used to sequentially add Gaussian noise to the second time series within a plurality of diffusion steps, starting from the first diffusion step and ending at the last diffusion step, to obtain a fifth time series;

[0121] The removal submodule is used to remove the first noise from the fifth time series in sequence within a plurality of reverse steps, starting from the first reverse step and ending at the last reverse step, to obtain the third time series. The first noise is determined by a pre-acquired network approximator, and the reverse step is the same in number as the diffusion step and in the opposite direction.

[0122] Optionally, add submodules, including:

[0123] A calculation unit, configured to calculate, for any diffusion step length among the multiple diffusion step lengths, using a variance scheduling parameter of the arbitrary diffusion step length, a previous time series of the arbitrary diffusion step length, and a unit matrix to obtain a first normal distribution of the arbitrary diffusion step length;

[0124] A first sampling unit, used for sampling from the first normal distribution to obtain Gaussian noise;

[0125] An adding unit, used for adding the Gaussian noise to the second time series;

[0126] The first determining unit is configured to determine, when the arbitrary diffusion step length is the last diffusion step length among the multiple diffusion step lengths, the second time series to which Gaussian noise is added as the fifth time series.

[0127] Optionally, remove submodules, including:

[0128] A prediction unit, configured to predict, for any reverse step length among the plurality of reverse step lengths, a first noise in the any reverse step length using a network approximator;

[0129] A calculation unit, configured to calculate a mean and a variance corresponding to the arbitrary reverse step length using the first noise;

[0130] A second sampling unit is used for sampling in a second normal distribution to obtain a sixth time series of the arbitrary reverse step length, wherein the second normal distribution is determined by the mean and variance;

[0131] The second determining unit is configured to determine the sixth time series as the third time series when the arbitrary reverse step length is the last reverse step length among the multiple reverse step lengths.

[0132] Optionally, the acquisition module 203 includes:

[0133] A projection submodule, used for projecting the third time series into an embedding space to obtain embedding space data;

[0134] A learning submodule, used for performing graph learning using the embedding space data to obtain a graph set, each graph in the graph set including an embedding matrix and an adjacency matrix;

[0135] A processing submodule is used to process each of the graphs using a graph neural network to determine the node embedding of each of the graphs, wherein the node embedding includes the dependency relationship between the data variables.

[0136] Optionally, the calculation module 205 includes:

[0137] A first calculation submodule, configured to calculate a first score using the first time series, the second time series and a first formula;

[0138] A second calculation submodule, configured to calculate a second score using the third time series, the fourth time series and the second formula;

[0139] A determination submodule is used to obtain the abnormality score by using the first score, the second score and a third formula.

[0140] Optionally, the detection module 206 is specifically configured to:

[0141] In the case where the abnormality score is greater than a preset score threshold, the abnormality score is determined as the abnormal data value.

[0142] It should be noted that the sequence detection device 200 is a device corresponding to the above-mentioned sequence detection method, and all implementation methods in the above-mentioned method embodiment are applicable to the embodiment of the device and can achieve the same technical effect.

[0143] Figure 3 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application is shown.

[0144] The terminal device may include a processor 301 and a memory 302 storing computer program instructions.

[0145] Specifically, the processor 301 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0146] The memory 302 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 302 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 302 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 302 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 302 is a non-volatile solid-state memory.

[0147] In certain embodiments, the memory 302 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, in general, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0148] The processor 301 implements any one of the sequence detection methods in the above embodiments by reading and executing computer program instructions stored in the memory 302 .

[0149] In one example, the terminal device may further include a communication interface 303 and a bus 310. Figure 3 As shown, the processor 301, the memory 302, and the communication interface 303 are connected via a bus 310 and communicate with each other.

[0150] The communication interface 303 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0151] Bus 310 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 310 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0152] In addition, in combination with the sequence detection method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the sequence detection methods in the above embodiment is implemented.

[0153] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0154] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0155] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0156] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable sequence detection device to produce a machine so that these instructions executed by the processor of the computer or other programmable sequence detection device enable the realization of the function / action specified in one or more boxes of the flowchart and / or block diagram. This processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of the boxes in the block diagram and / or flowchart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0157] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A sequence detection method, characterized in that: The method comprises: Using a preset data shielding strategy to perform data shielding in a first time series to obtain a second time series, wherein the first time series is a time series containing contaminated data; performing diffusion processing and inverse processing on the second time series in sequence to obtain a purified third time series, wherein the third time series is a time series that does not contain polluted data; Using a graph learning strategy and a graph neural network, obtaining dependencies between data variables in the third time series; Reconstructing data of the third time series according to the dependency relationship to obtain a fourth time series; Calculating using the first time series, the second time series, and the fourth time series to obtain an abnormality score for each data value in the first time series; According to the anomaly score, anomaly detection is performed on each data value to obtain an abnormal data value.

2. The sequence detection method according to claim 1, characterized in that: The first time series includes a plurality of groups of data values ​​corresponding one-to-one to a plurality of first time stamps, and each group of data values ​​is collected through a plurality of variables; The method of using a preset data shielding strategy to perform data shielding in the first time series to obtain a second time series includes: In each of the plurality of first time stamps, a binary mask is used to randomly mask the data value corresponding to the variable to obtain a second time series; or Dividing the first time series into a plurality of data segments, and using a binary mask to randomly mask any data segment in the plurality of data segments to obtain a second time series; or In each of the multiple first timestamps, a binary mask is used to mask a data value corresponding to any first timestamp in the multiple first timestamps to obtain a second time series.

3. The sequence detection method according to claim 1, characterized in that: The step of sequentially performing diffusion processing and inverse processing on the second time series to obtain a purified third time series includes: In a plurality of diffusion steps, starting from the first diffusion step and ending at the last diffusion step, Gaussian noise is sequentially added to the second time series to obtain a fifth time series; Within multiple reverse steps, starting from the first reverse step to the last reverse step, the first noise is removed from the fifth time series in sequence to obtain the third time series, wherein the first noise is determined by a pre-acquired network approximator, and the reverse step is the same in number as the diffusion step and in opposite direction.

4. The sequence detection method according to claim 3, characterized in that: The step of adding Gaussian noise to the second time series in sequence from the first diffusion step to the last diffusion step within the plurality of diffusion steps to obtain a fifth time series includes: For any diffusion step length among the multiple diffusion step lengths, a variance scheduling parameter of the arbitrary diffusion step length, a previous time series of the arbitrary diffusion step length, and a unit matrix are used to perform calculation to obtain a first normal distribution of the arbitrary diffusion step length; Sampling from the first normal distribution to obtain Gaussian noise; adding the Gaussian noise to the second time series; In a case where the arbitrary diffusion step length is the last diffusion step length among the plurality of diffusion step lengths, the second time series to which Gaussian noise is added is determined as the fifth time series.

5. The sequence detection method according to claim 3, characterized in that: The first noise is removed from the fifth time series in sequence from the first reverse step to the last reverse step within the plurality of reverse steps to obtain the third time series, including: For any reverse step length among the plurality of reverse step lengths, predicting a first noise in the any reverse step length using a network approximator; Calculating the mean and variance corresponding to the arbitrary reverse step length using the first noise; Sampling in a second normal distribution to obtain a sixth time series of the arbitrary reverse step length, wherein the second normal distribution is determined by the mean and variance; In a case where the arbitrary reverse step is the last reverse step among the plurality of reverse steps, the sixth time series is determined as the third time series.

6. The sequence detection method according to claim 1, characterized in that: The using of a graph learning strategy and a graph neural network to obtain the dependency relationship between the data variables in the third time series includes: Projecting the third time series into an embedding space to obtain embedding space data; Performing graph learning using the embedding space data to obtain a graph set, each graph in the graph set including an embedding matrix and an adjacency matrix; Each of the graphs is processed using a graph neural network to determine a node embedding of each of the graphs, wherein the node embedding includes dependencies between the data variables.

7. The sequence detection method according to claim 1, characterized in that: The calculating using the first time series, the second time series, and the fourth time series to obtain an abnormality score for each data value in the first time series includes: Calculate a first score using the first time series, the second time series, and a first formula; Calculate a second score using the third time series, the fourth time series and the second formula; The anomaly score is obtained by using the first score, the second score and a third formula.

8. The sequence detection method according to claim 7, characterized in that: The first formula is: The second formula is: The third formula is: s=λ1s1+λ2s2 Among them, x (i) is the first time series, is the second time series, M is the masking matrix, K is the number of variables, L is the length of the data value, is the fourth time series, S1 is the first score, S2 is the second score, S is the anomaly score, λ1 is the preset first hyperparameter, and λ2 is the preset second hyperparameter.

9. The sequence detection method according to claim 1, characterized in that: The performing anomaly detection on each data value according to the anomaly score to obtain an abnormal data value includes: In the case where the abnormality score is greater than a preset score threshold, the abnormality score is determined as the abnormal data value.

10. A sequence detection device, characterized in that: The device includes: A shielding module, configured to use a preset data shielding strategy to perform data shielding in a first time series to obtain a second time series, wherein the first time series is a time series containing contaminated data; a purification module, used for sequentially performing diffusion processing and reverse processing on the second time series to obtain a purified third time series, wherein the third time series is a time series that does not contain polluted data; An acquisition module, used to acquire the dependency relationship between the data variables in the third time series by using a graph learning strategy and a graph neural network; A reconstruction module, used for reconstructing data of the third time series according to the dependency relationship to obtain a fourth time series; a calculation module, configured to perform calculation using the first time series, the second time series, the third time series, and the fourth time series to obtain an abnormality score for each data value in the first time series; The detection module is used to perform anomaly detection on each data value according to the anomaly score to obtain an abnormal data value.

11. A terminal device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the sequence detection method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the sequence detection method according to any one of claims 1 to 9 is implemented.

13. A computer program product, characterized in that The computer product comprises a computer program, and when the computer program is executed by a processor, the sequence detection method according to any one of claims 1 to 9 is implemented.

Images