Method for constructing time series data anomaly detection model, anomaly detection method and system

Abstract

The application discloses a kind of construction method of time series data anomaly detection model, anomaly detection method and system, reconstructs time series data using the model constructed based on TCN-LSTM-CMA self-encoder, generates reconstruction data;By comparing the time series data before and after reconstruction and reconstruction data, the reconstruction error is calculated;According to the calculated reconstruction error, the anomaly detection is carried out using the isolated forest algorithm, and the abnormal data in the time series data is identified.The application proposes a new TCN-LSTM-CMA self-encoder model construction method, and combines the isolated forest method to carry out time series data anomaly detection.The method overcomes the shortcomings of existing anomaly detection methods in accuracy, adaptability and robustness.The method has wide application prospects in time series data anomaly detection in the fields of industrial monitoring, network security and the like.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of big data / data processing, and particularly relates to a time series data anomaly detection model construction method, an anomaly detection method and a system. BACKGROUND

[0002] With the rapid development of Internet of Things (IoT) and big data technology, the massive time series data has increased the demand for processing these data. Time series data has complex multi-dimensional characteristics and time dependence, and is widely used in many fields, such as industrial monitoring, network traffic analysis, etc. Accurate detection of abnormal events in these data to ensure the stability and reliability of the system has become an important and urgent challenge.

[0003] Traditional anomaly detection methods usually rely on statistics and rule-based criteria, such as threshold-based detection methods and statistical models. These methods often have significant effects when dealing with simple time series data. However, with the increasing complexity and dimensionality of time series data, the limitations of traditional methods become increasingly apparent. For example, simple threshold methods are difficult to effectively capture complex relationships in multi-variable time series data, while statistical models face high computational complexity and insufficient generalization ability when dealing with high-dimensional data. In addition, these traditional methods often rely on a large amount of prior knowledge and empirical rules, and face problems such as weak generalization ability and low precision.

[0004] In recent years, with the rise of deep learning technology, neural network-based anomaly detection methods have gradually attracted attention. There are many studies in this area, such as the method for detecting anomalies in aircraft power supply system operation and maintenance data based on deep autoencoder disclosed in CN118503879A, which uses a bidirectional long short-term memory network (BiLSTM) based autoencoder model. The fixed threshold method set by humans is used for anomaly detection. However, this detection method relies on manual labeling and has significant shortcomings in detection accuracy. The bridge crack detection and recognition method and system based on unsupervised learning and big data disclosed in CN118536072A reduces the dependence on artificial rules, but cannot effectively identify complex dependency relationships and key feature information in time series data, resulting in unsatisfactory detection accuracy. SUMMARY

[0005] The present application aims to at least partially solve one of the technical problems in the related art.

[0006] One object of the present application is to provide a time series data anomaly detection model construction method that effectively captures long-time dependence and complex feature relationships in time series data with complex dependency relationships.

[0007] Another object of the present application is to provide a time series data anomaly detection method using the autoencoder constructed by the above method.

[0008] Still another object of the present application is to provide a detection system applying the time series data anomaly detection method.

[0009] Yet another object of the present application is to provide a medium, an electronic device and a computer program product for executing the time series data anomaly detection method.

[0010] To achieve the above objects, the present application provides a method for constructing a time series data anomaly detection model, comprising the following steps:

[0011] S1, constructing a data set generation module, the data set generation module acquires time series data and pre-processes the time series data to generate a data set;

[0012] S2, constructing an autoencoder module, the autoencoder module is composed of an encoder and a decoder;

[0013] The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially extracted through a time series convolution network, a long short-term memory network and a causal masking self-attention mechanism of the encoder part;

[0014] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data through a long short-term memory network and a time series convolution network of the decoder part.

[0015] Preferably, in step S1, the time series data is pre-processed, specifically including:

[0016] S11, normalizing, filling missing values and sequencing in time sequence of the time series data input into the data set generation module;

[0017] S12, constructing the data set using a sliding window method.

[0018] Preferably, in step S2, the encoder adopts a TCN-LSTM-CMA framework, and the pre-processed data set first enters a time series convolution network of the encoder part, which extracts useful feature sequences while maintaining the data structure;

[0019] The feature sequences output from the time series convolution network enter a long short-term memory network, which captures deep time features in the sequence and enhances the expression ability of the data implicit information;

[0020] After the encoding is completed, the feature sequence output by the long short-term memory network combines the causal mask self-attention mechanism to perform self-attention operation on the key points in the time sequence.

[0021] As preferred, in step S2, the decoder adopts an LSTM-TCN framework, and the feature sequence processed by the causal mask self-attention mechanism enters the long short-term memory network of the decoder part, and the long short-term memory network gradually restores the time dependence and structure information in the sequence.

[0022] The long short-term memory network transmits the decoded data to the time sequence convolution network module of the decoder part for final feature reconstruction and output.

[0023] In another aspect of the present application, a time sequence data anomaly detection method is provided, which firstly reconstructs time sequence data by using the time sequence data anomaly detection model constructed by the above construction method, and then continues the following steps:

[0024] S3, a reconstruction error is calculated by comparing the time sequence data before and after reconstruction and the reconstructed data;

[0025] S4, according to the calculated reconstruction error, an anomaly detection is performed by using an isolation forest algorithm to identify the abnormal data in the time sequence data.

[0026] In another aspect of the present application, a time sequence data anomaly detection system is provided, which comprises:

[0027] A time sequence data anomaly detection model construction module is used to construct a time sequence data anomaly detection model, and reconstruct time sequence data into reconstructed data similar to the time sequence data.

[0028] A reconstruction error acquisition module is used to calculate a reconstruction error by comparing the time sequence data before and after reconstruction and the reconstructed data.

[0029] An anomaly detection module is used to perform anomaly detection by using an isolation forest algorithm according to the calculated reconstruction error to identify the abnormal data in the time sequence data.

[0030] As preferred, the time sequence data anomaly detection model construction module comprises:

[0031] A data set generation sub-module is used to acquire time sequence data, and pre-process the time sequence data to generate a data set.

[0032] An autoencoder module sub-module is composed of an encoder and a decoder.

[0033] The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially extracted by the time sequence convolution network, the long short-term memory network and the causal mask self-attention mechanism of the encoder part.

[0034] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data via a long short-term memory network and a time convolution network of the decoder part.

[0035] In another aspect, the application provides a non-transitory computer-readable storage medium having stored thereon computer instructions, which cause a computer to execute the time series data anomaly detection method.

[0036] In another aspect, the application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor invokes logical instructions in the memory to execute the time series data anomaly detection method.

[0037] In another aspect, the application provides a computer program product, comprising a computer program, which can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, a computer can execute the time series data anomaly detection method.

[0038] Beneficial effects: the application uses a new way to realize the autoencoder. The encoding module and the decoding module of the autoencoder both adopt a new architecture. Among them, TCN-LSTM-CMA is used as the encoder module. In the decoder part, the corresponding LSTM-TCN structure is adopted. The TCN-LSTM-CMA structure can effectively capture the long-time dependence and complex feature relationship in the time series data. TCN can extract features of different time scales through different convolution layers, and enhance feature representation through dimension expansion, which improves the flexibility and diversity of the model. LSTM further strengthens the modeling ability of long-term relationship in time series, which can capture global features and trends across time steps, and the output obtained by this module is further processed by CMA, which can further enhance the attention of the model to key time points and important features. CMA not only ensures that the model can only rely on past information for prediction, prevents the leakage of future information, but also effectively improves the sensitivity and reaction speed of the model to time series abnormal changes by dynamically adjusting the importance of each time step, so as to better learn the time series features of the data and improve the accuracy and robustness of anomaly detection. This innovative architecture makes the model not only perform well in processing regular time series data, but also perform higher precision and reliability in complex, multi-dimensional time series scenarios.

[0039] The application uses an improved autoencoder combined with an isolation forest method for anomaly detection. The task of the autoencoder is to extract features and reconstruct the input time series data, capture the potential patterns and structures in the data, and reflect the degree of anomaly of the data through reconstruction error. The task of the isolation forest is to use the reconstruction error generated by the autoencoder as input to detect abnormal points. The isolation forest can effectively identify potential abnormal data points by analyzing the isolation of the data. The combination of the two can achieve efficient and accurate anomaly detection in complex time series data. The autoencoder is responsible for feature extraction and reconstruction, and the isolation forest is responsible for the final anomaly identification. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 A flowchart of the time series data anomaly detection method of the application. DETAILED DESCRIPTION

[0041] To make the purpose, technical scheme and advantages of the application clearer, the technical scheme in the application will be described clearly and completely below combined with the drawings in the application. Obviously, the described embodiments are part of the embodiments of the application, not all the embodiments, and they should not be understood as limiting the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application. In the description of the application, it should be understood that the terms used are only for the purpose of description, and should not be understood as indicating or implying relative importance.

[0042] The construction method of the time series data anomaly detection model provided by the application will be described below. Figure 1 The construction method of the time series data anomaly detection model provided by the application will be described below.

[0043] The purpose of the application is to detect time series data anomalies by a new TCN-LSTM-CMA autoencoder combined with an isolation forest to achieve efficient and accurate anomaly detection of complex time series data, thereby improving the stability and reliability of the system and solving the problems of low detection accuracy, poor adaptability, high computational complexity and artificial dependence in the prior art when processing complex time series data. Specifically, the purposes of the application are as follows:

[0044] 1. Improve the accuracy of anomaly detection: accurately capture long-term dependencies and key feature information in time series data to achieve high-precision detection of abnormal events and reduce false positives and false negatives.

[0045] 2. Enhance the adaptability and robustness of the system: enable the system to adapt to different types of time series data, effectively handle noise, changes and complex dependencies in the data, and be suitable for various application scenarios.

[0046] 3. Reduce dependence on artificial rules: using unsupervised learning mode, without artificial labeling or preset rules, realize the automation of detection process, improve efficiency.

[0047] Based on the above purposes, the present application proposes a TCN-LSTM-CMA self-encoder, combined with the isolated forest method, to realize efficient and accurate anomaly detection of complex time series data, greatly improving the detection accuracy and system robustness, and having important practical application value and wide application prospect. This method not only solves the problems of low detection accuracy, poor adaptability and excessive dependence on artificial rules in the prior art, but also provides an efficient and intelligent solution for time series data anomaly detection in industrial monitoring, network security and other fields.

[0048] First, the professional terms or abbreviations used in the present application are explained:

[0049] Autoencoder: Autoencoder is a neural network model mainly used for data dimensionality reduction, feature extraction and data reconstruction. It consists of an encoder and a decoder, which compresses the input data, learns the low-dimensional representation of the data, and reproduces the original data.

[0050] Temporal Convolutional Network (TCN): Temporal Convolutional Network is a deep learning model for processing sequence data. TCN uses causal convolution and dilated convolution to learn the temporal dependencies of data. Causal convolution ensures that the output time step only depends on the current and previous time steps, and does not depend on future time steps, to maintain the time order of time series data and avoid information leakage. In causal convolution, the action range of the convolution kernel is limited to the current and previous time steps. Dilated convolution is a method that inserts holes between adjacent elements of the convolution kernel to expand the receptive field of the convolution kernel. This method can capture longer temporal dependencies without increasing the size of the convolution kernel.

[0051] Long Short-Term Memory Network (LSTM): Long Short-Term Memory Network is an improved recurrent neural network (RNN) designed to solve the problem of gradient vanishing and gradient explosion in RNN. LSTM introduces a gating mechanism to effectively capture and utilize long-term dependencies in sequence data. LSTM has significant advantages in processing long sequence data.

[0052] Causal Masked Attention (CMA): Causal Masked Attention is an attention mechanism commonly used in sequence data processing, which ensures that only previous time step information is considered when predicting the current time step. It can effectively model the causal relationship of data, improve the prediction accuracy and interpretability of the model.

[0053] Isolation Forest: Isolation Forest is an unsupervised anomaly detection algorithm based on tree structure, which constructs decision trees by randomly selecting features and splitting values, and identifies anomalies by the depth of isolated points. Each tree in the isolation forest is constructed by randomly selecting features and splitting points, and the depth of the tree reflects the isolation degree of the sample. Anomaly points are usually isolated at a shallow tree level, while normal points need a deeper tree level to be isolated. The anomaly score of a sample is determined by calculating the average isolation depth of the sample in the forest. The higher the score, the more likely the sample is an anomaly point.

[0054] Next, the specific embodiments of the present application are given through the following examples, so as to explain the technical scheme of the present application in more detail.

[0055] Embodiment 1: The present embodiment provides a method for constructing a time series data anomaly detection model, comprising the following steps:

[0056] S1, constructing a data set generation module, the data set generation module acquires time series data and pre-processes the time series data to generate a data set;

[0057] S2, constructing an autoencoder module, the autoencoder module consists of an encoder and a decoder;

[0058] The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially extracted through the time series convolution network, long short-term memory network and causal masking self-attention mechanism of the encoder part;

[0059] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data through the long short-term memory network and time series convolution network of the decoder part.

[0060] Specifically, step S1 is the construction step of the data set generation module:

[0061] S11, normalizing the data, filling in the missing values, and serializing according to the time sequence for the time series data input into the data set generation module;

[0062] S12, constructing the data set using the sliding window method, and the pre-processed time series data is shown in Table 1.

[0063] Table 1: Pre-processed time series data

[0064] Feature 1 Feature 2 ... Feature n timestamp t1 x1 <![CDATA[y1]]> ... ​ timestamp t2 x2 [ y2 ] ... ​ ... ... ... ... ... timestamp t n ]]> x n ]]> [[ y n ]]> ... z n ]]>

[0065] For the time series data in Table 1, taking the timestep as 10, the constructed data set is shown in Table 2.

[0066] Table 2 constructed dataset

[0067]

[0068]

[0069] Step S2 is a step of constructing a self-encoder module. The constructed time series dataset is input into the self-encoder model. The goal of the self-encoder is to learn an effective compressed representation (encoding part), and then reconstruct the input sequence from this representation (decoding part).

[0070] The self-encoder module is composed of two parts, an encoder and a decoder.

[0071] The encoder in this embodiment adopts a TCN-LSTM-CMA framework.

[0072] TCN encoding:

[0073] The model first receives a sequence data with shape (batch_size, time_steps, n), where batch_size is the number of samples sent into the model in one training iteration, time_steps represents the time step, and n represents the number of features. TCN (Temporal Convolutional Network) extracts local features in the sequence through causal convolution and dilated convolution operations. The result of convolution is to map the input n features to a higher dimension hidden_dim, so as to capture more rich time sequence information. The output shape is (batch_size, time_steps, hidden_dim), where hidden_dim is the dimension of the hidden layer.

[0074] TCN uses causal convolution and dilated convolution to capture the time dependence in the data, while maintaining the structure of the data and extracting useful feature sequences.

[0075] LSTM encoding:

[0076] LSTM (Long Short-Term Memory Network) further processes the output from TCN. LSTM will generate a series of hidden states, where the last hidden state contains the comprehensive information of the entire sequence. Extract the hidden state of the last time step, shape (batch_size, 1, hidden_dim), for subsequent steps.

[0077] LSTM further models the long-term dependencies in the time series, captures deep time features in the sequence, and enhances the expression ability of the implicit information in the data.

[0078] Causal masking self-attention layer:

[0079] The last hidden state of the LSTM encoder is repeated time_steps times to form an input with shape (batch_size, time_steps, hidden_dim). The Causal Masked Attention (CMA) mechanism masks future information by calculating the relevance of each position in the input sequence, focusing only on historical information relevant to the current time step, ensuring that the model only makes predictions based on known past information. The output shape remains (batch_size, time_steps, hidden_dim), where each time step's data has undergone causal masking and contains attention to historical information.

[0080] The Causal Masked Self-Attention (CMA) mechanism enhances the model's selective attention to important time points by performing self-attention operations on key points in the time series, while maintaining causality and avoiding information leakage. This mechanism ensures that the model can better capture abnormal features when processing time series, thereby improving reconstruction quality and accuracy of anomaly detection.

[0081] In this embodiment, the decoder uses the LSTM-TCN framework.

[0082] LSTM decoding:

[0083] The feature sequence processed by CMA enters the decoder part. LSTM decodes these data, and the output shape is (batch_size, time_steps, hidden_dim).

[0084] The decoder first uses the LSTM module for decoding, gradually restoring the time dependency and structural information in the sequence to maintain the continuity and time characteristics of the data.

[0085] TCN decoding:

[0086] The data decoded by LSTM is passed to the TCN module, and the TCN decoder maps the hidden state sequence back to the original feature space through inverse convolution operations. This step decodes the high-dimensional hidden state back to the original feature with practical significance, thus recovering to the feature dimension of the input data. The final output shape is (batch_size, time_steps, n), which is the same as the initial input shape, meaning that the model successfully encodes and decodes the original data, learns and reconstructs the reconstructed dataset as shown in Table 3 and the reconstructed time series data as shown in Table 4.

[0087] Table 3 Reconstructed dataset

[0088]

[0089]

[0090] Table 4 Reconstruction timing data

[0091] Feature sequence timestamp t 10 ]] [[x 10 ,y 10 ...z 10 ]]]> timestamp t 11 ]] [[x 11 ,y 11 ...z 11 ]]]> ... ... timestamp t n ]]> [[x n ,y n ...z n ]]]>

[0092] The TCN decoder performs the final feature reconstruction and output. The TCN decoder generates a reconstructed sequence similar to the original input data through convolution operations, ensuring the structural reconstruction of the data.

[0093] In summary, the construction method of the timing data anomaly detection model of embodiment 1 provides a new way to realize the autoencoder. The encoding module and the decoding module of the autoencoder both adopt a new architecture. Among them, TCN-LSTM-CMA is used as the encoder module. In the decoder part, the corresponding LSTM-TCN structure is adopted. The TCN-LSTM-CMA structure can effectively capture the long-time dependence and complex feature relationship in the timing data. TCN can extract features of different time scales through different convolution layers and enhance feature representation through dimension expansion, improving the flexibility and diversity of the model. LSTM further strengthens the modeling ability of long-term relationships in time series, can capture global features and trends across time steps, and the output obtained by this module is further processed by CMA, which can further enhance the model's attention to key time points and important features. CMA not only ensures that the model can only rely on past information for prediction, preventing the leakage of future information, but also effectively improves the sensitivity and reaction speed of the model to timing abnormal changes by dynamically adjusting the importance of each time step, so as to better learn the timing features of the data and improve the accuracy and robustness of anomaly detection. This innovative architecture makes the model not only perform well in processing regular timing data, but also perform higher precision and reliability in complex, multi-dimensional time series scenarios.

[0094] Embodiment 2: The embodiment provides a timing data anomaly detection method.

[0095] First, the construction method of embodiment 1 can be used to construct a timing data anomaly detection model, thereby reconstructing the timing data; on this basis, the following steps are continued:

[0096] S3, calculate the reconstruction error by comparing the timing data before and after reconstruction and the reconstructed data;

[0097] The original input sequence is denoted as: T = [x, y,...,z]

[0098] The reconstructed input sequence is denoted as: T + = [x', y',...,z']

[0099] The reconstruction error calculation formula is: ε = [x-x+ y-y + ..., z-z + ]

[0100] By comparing the reconstructed sequence with the original input data, a reconstruction error is calculated. The size of the reconstruction error reflects the degree of abnormality of the data. A larger error may indicate that the data point is abnormal, and the calculation result will be used in the subsequent anomaly detection step.

[0101] S4, according to the calculated reconstruction error, using the isolation forest algorithm for anomaly detection, identifying the abnormal data in the time series data.

[0102] Isolation Forest is an unsupervised anomaly detection algorithm, and its basic idea is to construct a set of isolation trees by randomly selecting features and splitting values, so as to isolate data points. Abnormal points are usually isolated faster because they are relatively sparse in the data set, that is, they have shorter path lengths. The average path length of multiple isolation trees is used to calculate the anomaly score of each data point. The higher the score, the more likely it is an abnormal point. Isolation forest does not require pre-labeled data and is very efficient when dealing with high-dimensional data. The closer the anomaly score is to 1, the more likely it is an abnormal point, and the closer it is to 0, the more likely it is a normal point.

[0103] The embodiment can accurately identify abnormal points in complex time series data by combining TCN-LSTM-CMA autoencoder with isolation forest. Compared with traditional single model method, TCN-LSTM-CMA autoencoder can fully extract local and global features of time series data. At the same time, the isolation forest model further improves the accuracy of anomaly detection by modeling the reconstruction error, and avoids complex manual rule setting, effectively reducing the false positive rate and the false negative rate.

[0104] Embodiment 3: The embodiment provides a time series data anomaly detection system, comprising:

[0105] A time series data anomaly detection model construction module is used to construct a time series data anomaly detection model, and reconstruct time series data into reconstructed data similar to the time series data, comprising:

[0106] A data set generation sub-module is used to obtain time series data and preprocess the time series data to generate a data set;

[0107] The autoencoder module sub-module is composed of an encoder and a decoder;

[0108] The encoder uses a TCN-LSTM-CMA framework, and the data set is sequentially passed through the time series convolution network, the long short-term memory network and the causal masking self-attention mechanism of the encoder part to extract features;

[0109] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data via a long short-term memory network and a time convolution network of the decoder part.

[0110] The reconstruction error acquisition module is configured to calculate the reconstruction error by comparing the time series data before and after reconstruction and the reconstructed data.

[0111] The anomaly detection module is configured to perform anomaly detection using an isolation forest algorithm according to the calculated reconstruction error to identify abnormal data in the time series data.

[0112] Embodiment 4: The embodiment provides a non-transitory computer readable storage medium having computer instructions stored thereon, the computer instructions causing a computer to execute a time series data anomaly detection method, the method comprising the following steps:

[0113] S1, a data set generation module is constructed, the data set generation module acquires time series data and pre-processes the time series data to generate a data set;

[0114] S2, a self-encoder module is constructed, the self-encoder module is composed of an encoder and a decoder;

[0115] The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially extracted features via a time convolution network, a long short-term memory network and a causal masking self-attention mechanism of the encoder part;

[0116] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data via a long short-term memory network and a time convolution network of the decoder part.

[0117] S3, calculate the reconstruction error by comparing the time series data before and after reconstruction and the reconstructed data;

[0118] S4, according to the calculated reconstruction error, an isolation forest algorithm is used for anomaly detection to identify abnormal data in the time series data.

[0119] Embodiment 5: The embodiment provides an electronic device, which can include a processor, a communications interface, a memory and a communication bus, wherein the processor, the communications interface and the memory complete mutual communication through the communication bus. The processor can call the logic instructions in the memory to execute a time series data anomaly detection method, the method comprising the following steps:

[0120] S1, a data set generation module is constructed, the data set generation module acquires time series data, and pre-processes the time series data to generate a data set;

[0121] S2, a self-encoder module is constructed, the self-encoder module is composed of an encoder and a decoder;

[0122] The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially extracted through a time series convolution network, a long short-term memory network and a causal masking self-attention mechanism of the encoder part;

[0123] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data through a long short-term memory network and a time series convolution network of the decoder part.

[0124] S3, by comparing the time series data before and after reconstruction and the reconstructed data, the reconstruction error is calculated;

[0125] S4, according to the calculated reconstruction error, an isolated forest algorithm is used for anomaly detection to identify abnormal data in the time series data.

[0126] In addition, the logical instructions in the above-mentioned memory can be realized in the form of a software function unit and sold or used as a separate product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and various program code storage media.

[0127] Embodiment 6: The present embodiment provides a computer program product, the computer program product comprises a computer program, the computer program can be stored on a non-transient computer readable storage medium, when the computer program is executed by a processor, the computer can execute a time series data anomaly detection method, the method comprises the following steps:

[0128] S1, a data set generation module is constructed, the data set generation module acquires time series data, and pre-processes the time series data to generate a data set;

[0129] S2, construct a self-encoder module composed of an encoder and a decoder;

[0130] The encoder adopts a TCN-LSTM-CMA framework, and the dataset is sequentially extracted features via a time convolution network, a long short-term memory network and a causal masking self-attention mechanism of the encoder part;

[0131] The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially reconstructed into reconstructed data similar to the time series data via a long short-term memory network and a time convolution network of the decoder part.

[0132] S3, calculate the reconstruction error by comparing the time series data before and after reconstruction and the reconstructed data;

[0133] S4, according to the calculated reconstruction error, use the isolation forest algorithm for anomaly detection to identify the abnormal data in the time series data.

[0134] Through the above embodiments, the application corresponding to the purpose of the application has the following advantages:

[0135] 1. High precision detection: the application can accurately capture the complex dependency relationship and key feature information in the time series data, efficiently identify the abnormal points in the data, improve the precision of anomaly detection, and significantly reduce false positives and false negatives.

[0136] 2. Strong adaptability and robustness: the application can dynamically adjust the model parameters according to different time series data, thereby adapting to the needs of different scenarios. The system can maintain stable detection performance when facing noise, data anomalies or changes.

[0137] 3. Low dependence on human labor: the application uses an unsupervised learning mode, which does not require manual label annotation of the dataset, significantly reducing the dependence on human rules and prior knowledge.

[0138] 4. Strong data processing capability: the application can process high-dimensional, multi-variable complex time series data, accurately identify anomalies through hierarchical feature extraction of deep learning models, and is suitable for large-scale data analysis tasks.

[0139] In summary, the application proposes a new TCN-LSTM-CMA self-encoder method, and combines the isolation forest method to detect time series data anomalies. The above method overcomes the shortcomings of existing anomaly detection methods in precision, adaptability and robustness. The method has wide application prospects in time series data anomaly detection in the fields of industrial monitoring and network security.

[0140] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0141] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0142] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A time series data anomaly detection method, applied to network traffic analysis, characterized in that: The method comprises the following steps: S1, obtaining time series data and preprocessing the time series data to generate a data set; S2, constructing an autoencoder, the autoencoder comprising an encoder and a decoder; The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially subjected to a time convolution network, a long short-term memory network and a causal masking self-attention mechanism of the encoder part to extract features; The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially subjected to a long short-term memory network and a time convolution network of the decoder part to be reconstructed into reconstructed data similar to the time series data; S3, calculating reconstruction errors by comparing the time series data before and after reconstruction and the reconstructed data; S4, performing anomaly detection on the calculated reconstruction errors by using an isolation forest algorithm to identify abnormal data in the time series data.

2. The method of claim 1, wherein, In step S1, the preprocessing of the time series data specifically comprises: S11, normalizing, filling in missing values and sequencing in time sequence for the time series data input into the data set generation module; S12, constructing a data set by using a sliding window method.

3. The method of claim 1, wherein, In step S2, the encoder adopts a TCN-LSTM-CMA framework, and the preprocessed data set is first subjected to a time convolution network of the encoder part, and the time convolution network extracts useful feature sequences while maintaining the data structure; The feature sequences output from the time convolution network are subjected to a long short-term memory network, and the long short-term memory network captures deep time features in the sequences to enhance the expression ability of the data for the implicit information; After encoding, the feature sequences output by the long short-term memory network are combined with the causal masking self-attention mechanism to perform self-attention operation on the key points in the time sequence.

4. The time series data anomaly detection method of claim 3, wherein, In step S2, the decoder adopts an LSTM-TCN framework, and the feature sequences processed by the causal masking self-attention mechanism are subjected to a long short-term memory network of the decoder part, and the long short-term memory network gradually restores the time dependence and structure information in the sequences; The long short-term memory network transmits the decoded data to a time convolution network module of the decoder part for final feature reconstruction and output. 5.A time series data anomaly detection system applied to network traffic analysis, characterized in that, It comprises: a data set generation module for obtaining time series data and preprocessing the time series data to generate a data set; a data reconstruction module for constructing an autoencoder, the autoencoder comprising an encoder and a decoder; The encoder adopts a TCN-LSTM-CMA framework, and the data set is sequentially subjected to a time convolution network, a long short-term memory network and a causal masking self-attention mechanism of the encoder part to extract features; The decoder adopts an LSTM-TCN framework, and the features extracted by the encoder are sequentially subjected to a long short-term memory network and a time convolution network of the decoder part to be reconstructed into reconstructed data similar to the time series data; a reconstruction error acquisition module for calculating reconstruction errors by comparing the time series data before and after reconstruction and the reconstructed data; an anomaly detection module for performing anomaly detection on the calculated reconstruction errors by using an isolation forest algorithm to identify abnormal data in the time series data. 6.A non-transitory computer readable storage medium having stored thereon computer instructions that, when executed by a computer, cause the computer to perform the time series data anomaly detection method of claim 1.

7. An electronic device comprising: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication among each other through the communication bus, and the processor invokes the logic instructions in the memory to execute the time series data anomaly detection method of claim 1. 8.A computer program product, comprising a computer program, the computer program being stored in a non-transitory computer readable storage medium, and when the computer program is executed by a processor, a computer is capable of executing the time series data anomaly detection method of claim 1.

Images