An unsupervised anomaly perception system and anomaly detection method for multivariate time series

Abstract

The application provides a kind of multi-element time series unsupervised anomaly perception system for detecting whether there is anomaly in multi-element time series, the system comprises: data acquisition module for collecting original multi-element time series;Anomaly perception model for encoding and decoding original multi-element time series to obtain reconstructed multi-element time series;Abnormality evaluation module is used to calculate the abnormality degree quantization score of original multi-element time series based on original multi-element time series and reconstructed multi-element time series according to the preset evaluation method, and whether there is anomaly in original multi-element time series is evaluated based on abnormality degree quantization score according to preset evaluation rule.The application greatly reduces the parameter quantity and calculation complexity through lightweight architecture design, suitable for resource limited environment;Also, the feature representation of normal multi-element time series stored in memory slot is used to effectively identify abnormal data pattern, improve the accuracy and robustness of anomaly detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data anomaly perception, in particular, to an anomaly detection technology in the field of data anomaly perception, and more particularly to an unsupervised anomaly perception system for multivariate time series and an anomaly detection method. BACKGROUND

[0002] In the field of unsupervised anomaly detection for multivariate time series, with the increase of network scale and model complexity, existing technologies have made significant progress in handling complex multivariate time series. Existing technologies usually rely on deep learning models to achieve anomaly detection for multivariate time series, such as long short-term memory networks (LSTM), variational autoencoders (VAE), and attention mechanism-based Transformer networks. These models can effectively detect abnormal points or events in multivariate time series by capturing complex temporal correlations in multivariate time series. However, as the model size increases, the computational resource requirements of deep learning models also increase, making these models difficult to apply in resource-constrained environments such as edge computing, mobile devices, and embedded systems.

[0003] Specifically, LSTM-based models, which perform well in handling multivariate time series, are particularly suitable for long-term dependency problems. However, such models usually contain a large number of parameters, with high training and inference overheads, and are prone to overfitting when handling high-dimensional multivariate time series. In addition, the anomaly detection capability of LSTM models relies on reconstruction error, which may not be able to fully capture global patterns.

[0004] VAE and GAN models, these generative models can generate realistic samples of normal multivariate time series by modeling the latent space of normal multivariate time series, and detect anomalies through reconstruction error. However, these models have high computational overheads and strong assumptions about multivariate time series, such as the VAE model usually assumes that the data distribution is Gaussian, which is not suitable for non-Gaussian data. Furthermore, in practical applications, these generative models have slow inference speed, making it difficult to meet real-time detection requirements.

[0005] Transformer models, which effectively capture long-term dependencies through self-attention mechanisms, have been proven to be effective in anomaly detection. In particular, on multivariate time series data, Transformer models can automatically focus on dependencies between different time steps and variables. However, the computational complexity of the Transformer model increases quadratically with the length of the multivariate time series, so in the case of long time series or high-frequency data, the computational resource consumption is extremely high. This makes it difficult to apply Transformer models in resource-limited scenarios.

[0006] Traditional machine learning methods: In addition to deep learning models, traditional methods such as Isolation Forest, Local Outlier Factor (LOF), and Support Vector Machine (SVM) also have applications in anomaly detection. These methods rely on local features and statistical laws of data, and are suitable for low-dimensional, clear feature multivariate time series. However, as the dimension and complexity of data increase, the performance of traditional methods gradually declines, and they cannot adapt to high-dimensional, complex multivariate time series.

[0007] In summary, although the existing technology has made significant progress in dealing with complex multivariate time series, there are still the following problems: first, the model complexity is high: the existing technology relies on large-scale networks and a large number of parameters, and cannot be applied to environments with limited computing resources; second, the scene adaptability is poor: most of the existing technology is designed for specific scenarios, and lacks adaptability under cross-domain tasks; third, the abnormal criterion is limited: existing models usually rely on one-sided abnormal criteria (such as only reconstruction error), and cannot capture gradual anomalies and other distribution drifts, affecting the performance of anomaly perception.

[0008] It should be noted that the background art is only used to introduce the relevant information of the present application, so as to facilitate the understanding of the technical solutions of the present application, but does not mean that the relevant information must be prior art. In the absence of evidence that the relevant information has been disclosed before the filing date of the present application, the relevant information should not be regarded as prior art. SUMMARY

[0009] Therefore, the purpose of the present application is to overcome the defects of the prior art, and to provide an unsupervised anomaly perception system for multivariate time series and an anomaly detection method for multivariate time series.

[0010] The purpose of the present application is achieved by the following technical solutions.

[0011] According to a first aspect of the present invention, an unsupervised anomaly perception system for a multivariate time series is provided for detecting whether a multivariate time series has an anomaly. The system comprises: a data acquisition module for acquiring an original multivariate time series, wherein the multivariate time series contains data of multiple dimensions at the same moment; an anomaly perception model for encoding and decoding the original multivariate time series to obtain a reconstructed multivariate time series; wherein the anomaly perception model is obtained by performing multiple rounds of iterative training using a preset objective function with the multivariate time series as input and the reconstructed multivariate time series as output, and the anomaly perception model comprises an encoder, a sparse contrast memory module and a decoder, wherein: the encoder is used to perform feature extraction on the multivariate time series to obtain a feature vector representation of the multivariate time series; the sparse contrast memory module comprises multiple Memory slots, each memory slot stores a feature representation of a normal multivariate time series, the sparse comparison module is configured to: calculate the similarity between the feature vector representation of the multivariate time series and the feature representation stored in each memory slot, and obtain a new feature vector representation of the multivariate time series according to a preset calculation method based on the feature representation stored in each memory slot and each calculated similarity; the decoder is used to decode the new feature vector representation of the multivariate time series to obtain a reconstructed multivariate time series; the anomaly assessment module is used to calculate the abnormality degree quantitative score of the original multivariate time series based on the original multivariate time series and the reconstructed multivariate time series according to a preset assessment method, and evaluate whether the original multivariate time series has an abnormality based on the abnormality degree quantitative score according to a preset assessment rule.

[0012] In some embodiments of the present invention, the sparse contrast memory module is configured to calculate the similarity between the feature vector representation of the multivariate time series and the feature representation stored in each memory slot as follows:

[0013]

[0014] in, The eigenvector representation of the multivariate time series is the same as the first The similarity between the feature representations stored in the memory slots, represents the eigenvector representation of a multivariate time series, represents the similarity measurement function, represents the temperature coefficient, Indicates the number of memory slots, Indicates the A memory slot, Indicates the A memory slot.

[0015] In some embodiments of the present invention, the preset calculation method is:

[0016]

[0017] in, A new feature vector representation representing a multivariate time series.

[0018] In some embodiments of the present invention, the preset objective function is:

[0019]

[0020] in,

[0021]

[0022] in,

[0023]

[0024] in,

[0025]

[0026] in,

[0027]

[0028] in, represents the objective function, represents the dynamic weighted reconstruction loss, represents the sparse similarity loss, represents the memory contrast loss, represents the first coefficient, represents the second coefficient, represents the number of multivariate time series, represents the number of dimensions contained in the multivariate time series, express Multivariate time series of moments Middle The weight of the dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle Dimensional data, Represents the reconstructed In a multivariate time series No. Dimensional data, Indicates the preset value. express The feature vector representation of the multivariate time series at the moment, Represents all memory slots and feature vector representation The closest positive memory slot, Represents all memory slots and feature vector representation The next closest negative memory slot, Indicates the boundary, represents the symbolic function, Indicates the A memory slot.

[0029] In some embodiments of the present invention, the preset evaluation method is:

[0030]

[0031] in,

[0032]

[0033]

[0034] in,

[0035]

[0036] in, express Multivariate time series of moments The quantitative score of abnormality, represents the first indicator parameter, Represents the second index parameter, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express In the multivariate time series of The reconstruction error of the data in dimensions, express Multivariate time series of moments The Euclidean distance to the nearest memory slot among all memory slots, represents the encoder, represents the encoder weights, Indicates that all memory slots are Multivariate time series of moments The closest memory slot.

[0037] In some embodiments of the present application, the preset evaluation rule is that if the abnormality degree quantification score of the original multivariate time series is less than or equal to a preset threshold, the original multivariate time series is normal data, otherwise, it is abnormal data.

[0038] In some embodiments of the present application, the encoder and the decoder both adopt a single-layer full connection layer.

[0039] According to a second aspect of the present application, a multivariate time series anomaly detection method is provided, which comprises: step S1, obtaining a multivariate time series to be processed; and step S2, using the system according to the first aspect of the present application to perform anomaly detection on the multivariate time series to be processed.

[0040] Compared with the prior art, the present application has the following advantages: (1) the unsupervised anomaly perception system greatly reduces the parameter quantity and computational complexity through a lightweight architecture design, and is suitable for resource-constrained environments; (2) the introduction of the memory slot in the anomaly perception model enables the anomaly perception model to effectively identify complex abnormal data patterns based on the feature representation of the normal multivariate time series stored in the memory slot, thereby improving the accuracy and robustness of anomaly detection; (3) the introduction of the dynamic weighted reconstruction loss during training of the anomaly perception model enables the anomaly perception model to better handle dependencies in time series, and the introduction of the sparse similarity loss and the memory contrast loss enables the model to distinguish different normal multivariate time series while paying more attention to global features, which is conducive to improving the accuracy of anomaly detection; (4) the anomaly evaluation module considers the information of the reconstruction space, the time space and the latent space to calculate a comprehensive abnormality degree quantification score, further improving the comprehensiveness and accuracy of anomaly detection. BRIEF DESCRIPTION OF DRAWINGS

[0041] The embodiments of the present application will be further described below with reference to the accompanying drawings, in which:

[0042] Figure 1 FIG. 1 is a schematic diagram of an unsupervised anomaly perception system according to an embodiment of the present application;

[0043] Figure 2 FIG. 2 is a schematic diagram of an anomaly perception model according to an embodiment of the present application;

[0044] Figure 3 FIG. 3 is an example schematic diagram of the training stage and the detection stage of the unsupervised anomaly perception system according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] For the purpose of the present application, the technical solutions and advantages are more clear and explicit, the following will be further described in detail by specific embodiments combined with the drawings. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0046] As mentioned in the background section, although the prior art has made significant progress in dealing with complex multivariate time series, there are still the following problems: first, the model complexity is high: the prior art relies on large-scale networks and a large number of parameters, which cannot be applied to environments with limited computing resources; second, poor scene adaptability: most of the prior art is designed for specific scenarios, and lacks adaptability to cross-domain tasks; third, limited abnormal criterion: existing models usually rely on one-sided abnormal criterion (such as: only reconstruction error), which cannot capture gradual abnormality and other distribution drift, affecting abnormal perception performance.

[0047] In order to solve the above problems, the inventors have studied and analyzed the prior art, and found that existing large-scale models (such as LSTM, Transformer, etc.) rely on a large number of parameters and complex structures to capture complex time series correlations in multivariate time series, and then realize anomaly detection. Although existing models can achieve good detection results in resource-rich environments, they cannot be applied in scenarios with limited computing resources. Although the model complexity can be reduced by reducing the number of network layers and neurons, this direct reduction of model size often leads to a significant decrease in model performance, making the model unable to effectively learn important features in multivariate time series, affecting the abnormal detection effect. In addition to the problem of excessive model parameter size, the inventors have found that most existing deep learning models are designed for specific scenarios and lack adaptability to cross-domain tasks, for example, VAE models usually assume that the data distribution is Gaussian, which is not suitable for non-Gaussian data. In addition to the problems of excessive model parameter size and poor scene adaptability, the inventors have found that in multivariate time series, anomalies may manifest as changes in certain global patterns, rather than just deviations in local features. For example, a multivariate time series composed of multiple dimensions of medical data, anomalies may not only manifest as anomalies in a single dimension of medical data, but also as changes in complex time series relationships between multiple dimensions of medical data. These global anomaly patterns are often difficult to detect by models that only consider local features (such as traditional isolation forests or local window-based models), and most existing models focus only on reconstruction error or similarity in local time or feature dimensions when dealing with anomaly detection, which prevents the model from effectively capturing global correlation features in multivariate time series, especially when normal patterns and abnormal patterns are similar in local features. The existing model is prone to miss detection or false detection (some abnormal patterns may have a high degree of similarity with normal patterns in the short term, but will show significant differences when observed globally).

[0048] Based on the above analysis, the inventors propose an anomaly perception system that can be applied to resource-constrained scenarios, which includes a data acquisition module, an anomaly perception model, and an anomaly evaluation module. The data acquisition module is used to collect original multivariate time series. The anomaly perception model is used to encode and decode the original multivariate time series data to obtain reconstructed multivariate time series. The anomaly perception model reduces model complexity by reducing the number of network layers and neurons, thereby reducing the computational resources required for model encoding and decoding. At the same time, a plurality of memory slots with a minimal parameter space are introduced into the anomaly perception model to store the feature representation of normal multivariate time series. The feature representation of normal multivariate time series stored in each memory slot is calculated for similarity with the original multivariate time series to retrieve normal data patterns in the original multivariate time series, and the multivariate time series is reconstructed based on the similarity calculation result. The difference between the reconstructed multivariate time series and the original multivariate time series is analyzed to realize anomaly detection. The introduction of memory slots in the anomaly perception model not only makes up for the performance loss caused by the reduction of anomaly perception model parameters, but also effectively improves the adaptability and robustness of the anomaly perception model in resource-constrained scenarios. The anomaly evaluation module is used to calculate the anomaly degree quantification score of the original multivariate time series based on the original multivariate time series and the reconstructed multivariate time series according to the preset evaluation method, and to analyze whether the original multivariate time series is abnormal based on the anomaly degree quantification score. Considering the defects of existing technologies, the anomaly evaluation module fuses information in multiple different dimensional spaces when calculating the anomaly degree quantification score, thereby effectively identifying global anomalies and avoiding missed detection of anomalies due to focusing only on local features.

[0049] In summary, as Figure 1As shown, the present application provides an unsupervised anomaly perception system for multi-dimensional time series, which is used to detect whether there is an anomaly in the multi-dimensional time series, and the system comprises: a data acquisition module, which is used to acquire the original multi-dimensional time series, wherein the multi-dimensional time series contains data of multiple dimensions at the same time; an anomaly perception model, which is used to perform encoding and decoding processing on the original multi-dimensional time series to obtain the reconstructed multi-dimensional time series; wherein the anomaly perception model is obtained by performing multi-round iteration training on the preset target function with the multi-dimensional time series as the input and the reconstructed multi-dimensional time series as the output, and the anomaly perception model comprises an encoder, a sparse contrast memory module and a decoder, wherein: the encoder is used to extract features of the multi-dimensional time series to obtain a feature vector representation of the multi-dimensional time series; the sparse contrast memory module comprises a plurality of memory slots, each memory slot stores a feature representation of a normal multi-dimensional time series, and the sparse contrast module is configured to: calculate the similarity between the feature vector representation of the multi-dimensional time series and the feature representation stored in each memory slot, and obtain a new feature vector representation of the multi-dimensional time series based on the feature representation stored in each memory slot and each calculated similarity according to a preset calculation manner; the decoder is used to perform decoding processing on the new feature vector representation of the multi-dimensional time series to obtain the reconstructed multi-dimensional time series; and an anomaly evaluation module, which is used to calculate an anomaly degree quantitative score of the original multi-dimensional time series based on the original multi-dimensional time series and the reconstructed multi-dimensional time series according to a preset evaluation manner, and evaluate whether there is an anomaly in the original multi-dimensional time series based on the anomaly degree quantitative score according to a preset evaluation rule.

[0050] In order to better understand the present application, each component of the unsupervised anomaly perception system will be described in detail below in combination with specific embodiments.

[0051] I. Data acquisition module

[0052] The data acquisition module is used to acquire the original multi-dimensional time series. It should be noted that the data acquisition module can be set to use a multi-dimensional sensor to acquire and collect the multi-dimensional time series, and to transmit the acquired multi-dimensional time series to the anomaly perception model through a readable and writable storage medium or a communicable data transmission medium; or it can be set to only receive the multi-dimensional time series. It should also be noted that a multi-dimensional time series can be represented as wherein, represents the multi-dimensional time series at time t, represents the data of the first dimension of the multi-dimensional time series at time t, represents the data of the second dimension of the multi-dimensional time series at time t, represents The data of the n-th dimension of the multivariate time series at the time t, where the dimension refers to the data collected by different sensors. For example, assuming that To represent the multivariate time series of weather changes, can be represented as The temperature data collected by the temperature sensor at the time t, can be represented as The humidity data collected by the humidity sensor at the time t, can be represented as The wind direction data collected by the wind direction sensor at the time t.

[0053] II. Anomaly perception model

[0054] The anomaly perception model is used to encode and decode the original multivariate time series to obtain the reconstructed multivariate time series. The anomaly perception model takes the multivariate time series as input and the reconstructed multivariate time series as output, and is obtained by performing multiple rounds of iterative training using a preset objective function. As shown in Figure 2 The anomaly perception model includes an encoder, a sparse contrast memory module, and a decoder. Each component of the anomaly perception model will be described one by one below.

[0055] The encoder is used to extract features of the multivariate time series to obtain a feature vector representation of the multivariate time series. The encoder is responsible for compressing the multi-dimensional multivariate time series into a low-dimensional latent vector representation (feature vector representation). This process not only reduces the data dimension and reduces the computational complexity, but also preserves the key information in the multivariate time series. The feature extraction process of the encoder can be represented as: wherein, represents the mapping function of the encoder, represents the multivariate time series, represents the compressed latent vector representation (feature vector representation). It should be noted that in order to ensure that the anomaly perception model can be applied to resource-constrained scenarios and has efficient encoding and decoding processing capabilities, the encoder uses a single-layer fully connected layer. Other network layers suitable for resource-constrained scenarios can also be used as the encoder, and the present application does not make special limitations.

[0056] The sparse contrast memory module includes a plurality of memory slots, each memory slot storing a feature representation of a normal multivariate time series, and the sparse contrast module is configured to: calculate a similarity between the feature vector representation of the multivariate time series and the feature representation stored in each memory slot, and obtain a new feature vector representation of the multivariate time series based on the feature representation stored in each memory slot and each calculated similarity according to a preset calculation manner. The sparse contrast memory module combines the ideas of memory network and sparse learning, and can efficiently and accurately retrieve the feature representation of the normal multivariate time series stored in the memory slot most similar to the multivariate time series. Moreover, the memory slots in the sparse contrast memory module can be trained, that is, the memory slots can learn the normal patterns of different multivariate time series in iterative training. The plurality of memory slots in the sparse contrast memory module can be represented as: , denoted as a set of memory slots, denotes the first memory slot, denotes the second memory slot, denotes the nth memory slot, and each memory slot includes data of a plurality of dimensions.

[0057] It should be noted that the initial intention of setting the memory slots in the sparse contrast memory module is to overcome the shortcomings of large-scale models, and the feature representation of the normal multivariate time series is stored by introducing a plurality of memory slots with controllable and differentiable capacity, so that the anomaly perception model can accurately retrieve the feature representation of the normal multivariate time series stored in the memory slot most similar to the multivariate time series based on the memory slot, and then accurately identify the abnormal data. However, how to select a suitable memory capacity (i.e., the number of memory slots) is a key problem. Too few memory slots may not effectively cover the diversity of normal multivariate time series, resulting in a decrease in the detection accuracy of the anomaly perception model; and too many memory slots will increase the computational burden of the anomaly perception model, which is contrary to the initial intention of lightweight design. In order to ensure that the anomaly perception model can maintain high detection accuracy and will not bring excessive computational burden, the number of memory slots is set to be less than or equal to the number of spatial dimensions of the feature vector representation of the multivariate time series. For example, assuming that the number of spatial dimensions of the feature vector representation of the multivariate time series is 7, the number of memory slots needs to be less than or equal to 7.

[0058] According to an embodiment of the present application, the sparse contrast memory module is configured to calculate the similarity between the feature vector representation of the multivariate time series and the feature representation stored in each memory slot in the following manner:

[0059]

[0060] wherein, denotes the similarity between the feature vector representation of the multivariate time series and the feature representation stored in the first memory slot, similarity between feature representations stored in the memory slots, feature vector representation representing a multivariate time series, similarity measure function, temperature coefficient, number of memory slots, memory slot, memory slot, memory slot, memory slot. The similarity measure function can be a cosine similarity function wherein, memory slot, memory slot. Other similarity functions can also be used, such as inner product similarity, which is not specifically limited by the present application.

[0061] According to an embodiment of the present application, the preset calculation method is:

[0062]

[0063] wherein, new feature vector representation of the multivariate time series.

[0064] According to an embodiment of the present application, the preset objective function is:

[0065]

[0066] wherein, objective function, dynamic weighted reconstruction loss, sparse similarity loss, memory contrast loss, first coefficient, second coefficient. Each loss will be introduced one by one.

[0067] Before introducing the dynamic weighted reconstruction loss, the traditional objective loss is introduced as follows:

[0068]

[0069] wherein, number of multivariate time series, number of dimensions contained in the multivariate time series, reconstruction error of data of the i-th dimension of the multivariate time series at the t-th moment, reconstruction error of data of the i-th dimension of the multivariate time series at the t-th moment, multivariate time series Middle Dimensional data, Represents the reconstructed Multivariate time series of moments Middle In the traditional target loss In the paper, only the difference between the original multivariate time series and the reconstructed multivariate time series is focused on, while the temporal correlation and potential characteristic structure in the multivariate time series are ignored.

[0070] Compared with traditional target loss Different from the above, the dynamic weighted reconstruction loss proposed in this invention Considering the error contributions of different dimensions in the multivariate time series at each moment, and assigning different weights to the error contributions of different dimensions in the multivariate time series at each moment, the anomaly perception model can better handle the dependencies in the time series. It is expressed as follows:

[0071]

[0072] in, represents the number of multivariate time series, represents the number of dimensions contained in the multivariate time series, express Multivariate time series of moments Middle The weight of the dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle Dimensional data, Represents the reconstructed Multivariate time series of moments Middle Dimensional data.

[0073] Furthermore, in order to encourage the anomaly perception model to compare and remember the feature representations of different normal multivariate time series, a sparse similarity loss is introduced into the objective function. , specifically expressed as follows:

[0074]

[0075] in, Represents the preset value, ϵ is a very small value used to ensure numerical stability.

[0076] Furthermore, in order to distinguish the feature representations of different normal multivariate time series stored in the memory slots, the memory contrast loss is introduced into the objective function. , specifically expressed as follows:

[0077]

[0078] in,

[0079]

[0080] in, express The feature vector representation of the multivariate time series at the moment, Represents all memory slots and feature vector representation The closest positive memory slot, Represents all memory slots and feature vector representation The next closest negative memory slot, Indicates the boundary, represents a symbolic function, if If the number inside is positive, it returns the original value, otherwise it returns zero. Indicates the It should be noted that the memory contrast loss distinguishes normal multivariate time series stored in different memory slots by reducing the distance between the feature vector representation of the multivariate time series and its nearest memory slot, and maximizing the distance between the feature vector representation of the multivariate time series and its second nearest memory slot.

[0081] Based on the preset objective function proposed in the present invention, multiple rounds of iterative training are performed on the anomaly perception model. This enables the trained anomaly perception model to efficiently and quickly retrieve normal data patterns in the multivariate time series to reconstruct the multivariate time series, thereby achieving accurate identification of abnormal data. At the same time, it also pays attention to the local and global features of the multivariate time series, further improving the accuracy of anomaly detection.

[0082] The decoder is used to decode the new feature vector representation of the multivariate time series to obtain a reconstructed multivariate time series. It should be noted that to ensure that the anomaly perception model is applicable to resource-constrained scenarios and has efficient encoding and decoding processing capabilities, the decoder also uses a single fully connected layer. Other network layers suitable for resource-constrained scenarios can also serve as decoders, and the present invention does not impose any special limitations.

[0083] In order to better understand the anomaly perception model, the following describes the training process of the model. It should be noted that the anomaly perception model can be trained separately and then configured in the unsupervised anomaly perception system, or it can be trained directly in the unsupervised anomaly perception system. Figure 3 The training process is explained by the light yellow frame.

[0084] Depend on Figure 3 The training process for the anomaly perception model is as follows: first, a previously collected normal multivariate time series (historical data) is acquired; then, this historical data is passed to the data acquisition module, which then passes it to the anomaly perception model for multiple rounds of iterative training. During each round, the parameters of the anomaly perception model are updated using the preset objective function described in the previous embodiment until the model converges. It should be noted that during training, the anomaly perception model continuously learns the data patterns of normal multivariate time series and stores these patterns in the model.

[0085] 3. Abnormal Assessment Module

[0086] The anomaly assessment module is used to calculate the abnormality degree quantitative score of the original multivariate time series based on the original multivariate time series and the reconstructed multivariate time series according to a preset assessment method, and to assess whether the original multivariate time series has an abnormality based on the abnormality degree quantitative score according to a preset assessment rule.

[0087] Before explaining the preset evaluation method, let's first introduce the traditional anomaly evaluation method, which is specifically shown as follows:

[0088]

[0089] in, express Multivariate time series of moments The reconstruction error, represents the number of dimensions contained in the multivariate time series, express Multivariate time series of moments Middle Dimensional data, Represents the reconstructed Multivariate time series of moments Middle Traditional anomaly assessment methods only consider the information of the reconstructed space and lack the fusion of temporal space and latent space information, which is prone to missed detection or false detection.

[0090] Unlike traditional anomaly assessment methods, the assessment method proposed in this invention simultaneously performs anomaly detection in three different dimensions: reconstruction space, temporal space, and latent space. This multi-space detection method can significantly improve anomaly detection capabilities and reduce missed detections caused by only considering information in the reconstruction space. According to one embodiment of the present invention, the preset assessment method is:

[0091]

[0092] in,

[0093]

[0094]

[0095] in,

[0096]

[0097] in, express Multivariate time series of moments The quantitative score of abnormality, represents the first indicator parameter, represents the second index parameter, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments The Euclidean distance to the nearest memory slot among all memory slots, represents the encoder, represents the encoder weights, Indicates that all memory slots are Multivariate time series of moments The closest memory slot. Unlike traditional anomaly assessment methods, the preset assessment method integrates reconstruction space, time space, and latent space to calculate a comprehensive anomaly degree quantitative score. , which can better detect anomalies.

[0098] According to one embodiment of the present application, the preset evaluation rule is that if the abnormality degree quantification score of the original multivariate time series is less than or equal to a preset threshold, the original multivariate time series is normal data, otherwise, it is abnormal data. Specifically, if the abnormality degree quantification score AS is less than or equal to a preset threshold δ, the original multivariate time series is determined to be normal data; if the abnormality degree quantification score AS is greater than δ, the original multivariate time series is determined to be abnormal data.

[0099] In order to better understand the abnormality detection process of the unsupervised anomaly perception system, the following will be described in the detection process shown in the part selected by the purple box in FIG. 8. Figure 3 As can be seen from FIG. 8, the abnormality detection process is that the data acquisition module acquires the current multivariate time series (original online data), and transmits the original online data to the anomaly perception model; the anomaly perception model further encodes and decodes the original online data to obtain reconstructed online data; finally, the anomaly perception module calculates the abnormality degree quantification score based on the original online data and the reconstructed online data according to the preset evaluation method, and judges whether the original online data is abnormal based on the abnormality degree quantification score. Figure 3

[0100] As can be seen from the foregoing embodiments, the unsupervised anomaly perception system is a lightweight system suitable for resource-constrained environments, such as the jeston nano embedded platform. In order to adapt to the resource-constrained environment, the unsupervised anomaly perception system is configured with a simple structure anomaly perception model (the parameter quantity can be compressed to 0.1M), which can realize efficient and fast retrieval of normal mode data by introducing a memory slot to store the feature representation of the normal multivariate time series, which not only improves the accuracy of anomaly detection, but also reduces the computational overhead of the model. At the same time, in order to avoid the situation of missing detection and missing detection, the unsupervised anomaly perception system is also configured with an anomaly evaluation module, which considers the information of the reconstruction space, the time space and the latent space to calculate the comprehensive abnormality degree quantification score, which can more accurately detect anomalies.

[0101] Based on the foregoing embodiments of the unsupervised anomaly perception system, the present application further provides a multivariate time series anomaly detection method, which comprises the following steps: S1, acquiring a multivariate time series to be processed; S2, using the unsupervised anomaly perception system of the foregoing embodiments to detect the abnormality of the multivariate time series to be processed.

[0102] ​In order to verify the performance of the unsupervised anomaly perception system proposed in the present application, comparative experiments are carried out on real data sets PSM, SMAP, SWaT, MSL and SMD after replacing the anomaly perception model in the unsupervised anomaly perception system with OCSVM, LOF, IForest, U-Time, DAGMM, ITAD, VAR, MMPCACD, CL-MPPCA, TS-CP2, BeatGAN, BOCPD, Deep-SVDD, LSTM-VAE, LSTM or OmniAnomaly model respectively, and the experimental results are shown in Tables 1-3. Among them, Table 1 is the experimental results on data sets SMD and MSL, Table 2 is the experimental results on data sets SMAP and SWaT, Table 3 is the experimental results on data set PSM and the average of the experimental results on data sets PSM, SMAP, SWaT, MSL and SMD. In order to control the variable, the experimental settings remain completely consistent, and the experimental environment is: Ubuntu 18.04 LTS, Python3.1.0, and the graphics card uses NVIDIA RTX 3090.

[0103] As can be seen from Tables 1-3, compared with the anomaly perception system after replacing with other models, the unsupervised anomaly perception system proposed in the present application exhibits better performance in evaluation indexes on each data set. Among them, the evaluation index P represents the precision, which is used to measure the reliability of predicting positive samples; the evaluation index R represents the recall, which is used to measure the ability to find positive samples; and the evaluation index F1 represents the F1 score, which is used to comprehensively evaluate the precision and recall, and is the harmonic mean of the two.

[0104] Table 1

[0105]

[0106] Table 2

[0107]

[0108] Table 3

[0109]

[0110] The application has the following beneficial effects: (1) the unsupervised anomaly perception system greatly reduces the parameter quantity and calculation complexity through a lightweight architecture design, and is suitable for a resource-limited environment; (2) the memory slot is introduced in the anomaly perception model, so that the anomaly perception model can effectively identify complex abnormal data patterns based on the feature representation of the normal multivariate time series stored in the memory slot, thereby improving the accuracy and robustness of anomaly detection; (3) the dynamic weighted reconstruction loss is introduced when training the anomaly perception model, so that the anomaly perception model can better handle the dependency in the time series, and the sparse similarity loss and memory contrast loss are also introduced, so that the model can distinguish different normal multivariate time series and pay more attention to global features, which is beneficial to improve the accuracy of anomaly detection; (4) the anomaly evaluation module considers the information of the reconstruction space, the time space and the latent space to calculate a comprehensive anomaly degree quantitative score, further improving the comprehensiveness and accuracy of anomaly detection.

[0111] It should be noted that although the above describes each step in a specific order, it does not mean that each step must be performed in the above specific order, in fact, some of the steps can be executed concurrently, or even the order is changed, as long as the required function can be realized.

[0112] The present application can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present application.

[0113] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch cards or punched tape, and any suitable combination of the foregoing. A non-transitory, computer-readable storage medium does not include a signal.

[0114] Having described various embodiments of the application, it is to be understood that the above description is meant not to limit and not to encompass all of the possible embodiments covered by the claims. Many modifications and variations of this application can be apparent to those of ordinary skill in the art without departing from the spirit and scope of the described embodiments. It is intended that the scope of the application should only be limited by the appended claims.

Claims

1. An unsupervised anomaly perception system for multivariate time series, used to detect whether a multivariate time series has anomalies, characterized by: The system comprises: a data acquisition module for acquiring original multivariate time series, wherein the multivariate time series includes data of multiple dimensions at the same moment, and the multivariate time series includes surface soil moisture in the first dimension, root zone soil moisture in the second dimension, surface wetness in the third dimension, root zone wetness in the fourth dimension, total precipitation flux in the fifth dimension, total evaporation in the sixth dimension, surface temperature in the seventh dimension, vegetation opacity in the eighth dimension, vegetation moisture content in the ninth dimension, freeze-thaw ratio in the tenth dimension, soil bulk density in the eleventh dimension, clay content in the twelfth dimension, total original organic matter production in the thirteenth dimension, net ecosystem carbon dioxide exchange in the fourteenth dimension, soil porosity in the fifteenth dimension, and soil looseness in the sixteenth dimension; The anomaly perception model is used to encode and decode the original multivariate time series to obtain a reconstructed multivariate time series. The anomaly perception model is obtained by performing multiple rounds of iterative training using a preset objective function with the multivariate time series as input and the reconstructed multivariate time series as output. The anomaly perception model includes an encoder, a sparse contrast memory module, and a decoder, wherein: The encoder is used to extract features from the multivariate time series to obtain a feature vector representation of the multivariate time series; The sparse contrast memory module includes a plurality of memory slots, each memory slot storing a normal feature representation of a multivariate time series, and the sparse contrast module is configured to: calculate a similarity between a feature vector representation of the multivariate time series and a feature representation stored in each memory slot, and obtain a new feature vector representation of the multivariate time series according to a preset calculation method based on the feature representation stored in each memory slot and each calculated similarity; The decoder is used to decode the new feature vector representation of the multivariate time series to obtain a reconstructed multivariate time series; The anomaly assessment module is used to calculate the quantitative score of the degree of anomaly of the original multivariate time series based on the original multivariate time series and the reconstructed multivariate time series according to a preset assessment method, and to evaluate whether the original multivariate time series has anomalies based on the quantitative score of the degree of anomaly according to preset assessment rules.

2. The system according to claim 1, wherein: The sparse contrastive memory module is configured to compute the similarity between the feature vector representation of the multivariate time series and the feature representation stored in each memory slot as follows: in, The eigenvector representation of the multivariate time series is the same as the first The similarity between the feature representations stored in the memory slots, represents the eigenvector representation of a multivariate time series, represents the similarity measurement function, represents the temperature coefficient, Indicates the number of memory slots, Indicates the A memory slot, Indicates the A memory slot.

3. The system according to claim 2, characterized in that The default calculation method is: in, A new feature vector representation representing a multivariate time series.

4. The system according to claim 3, characterized in that The preset objective function is: in, in, in, in, in, represents the objective function, represents the dynamic weighted reconstruction loss, represents the sparse similarity loss, represents the memory contrast loss, represents the first coefficient, represents the second coefficient, represents the number of multivariate time series, represents the number of dimensions contained in the multivariate time series, express Multivariate time series of moments Middle The weight of the dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express In a multivariate time series No. Dimensional data, Represents the reconstructed Multivariate time series of moments Middle Dimensional data, Indicates the preset value. express The feature vector representation of the multivariate time series at the moment, Represents all memory slots and feature vector representation The closest positive memory slot, Represents all memory slots and feature vector representation The next closest negative memory slot, Indicates the boundary, represents the symbolic function, Indicates the A memory slot.

5. The system according to claim 4, characterized in that The preset evaluation method is: in, in, in, express Multivariate time series of moments The quantitative score of abnormality, represents the first indicator parameter, Represents the second index parameter, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments Middle The reconstruction error of the data in dimensions, express Multivariate time series of moments The Euclidean distance to the nearest memory slot among all memory slots, represents the encoder, represents the encoder weights, Indicates that all memory slots are Multivariate time series of moments The closest memory slot.

6. The system according to claim 5, characterized in that The preset evaluation rule is: if the abnormality quantitative score of the original multivariate time series is less than or equal to a preset threshold, the original multivariate time series is normal data; otherwise, it is abnormal data.

7. The system according to claim 6, characterized in that Both the encoder and decoder use a single fully connected layer.

8. A method for detecting anomalies in multivariate time series, characterized in that: The method comprises: Step S1, obtaining a multivariate time series to be processed; Step S2: Use the system as described in any one of claims 1 to 7 to perform anomaly detection on the multivariate time series to be processed.

9. A computer-readable storage medium, characterized in that A computer program is stored thereon, which can be executed by a processor to implement the steps of the method according to claim 8.

10. An electronic device, characterized in that: include: one or more processors; and a memory, wherein the memory is configured to store executable instructions; The one or more processors are configured to implement the steps of the method of claim 8 by executing the executable instructions.

Images