Application of a time series detection algorithm

Abstract

The present invention relates to an application of a time series detection algorithm, which belongs to the technology in data mining and is suitable for abnormal subsequence detection under electrocardiogram data. First, the local density of each data point in the subsequence in the dynamic time segment is evaluated to evaluate the abnormality of the base point, and then the abnormality of the subsequence is judged; when processing data, the algorithm makes full use of the information of the time series in the time dimension, solves the time drift problem existing in the time series, and can ensure the accuracy and effectiveness of the data results.

Description

Technical Field

[0001] The invention relates to an application of a time series detection algorithm, which belongs to the technology in data mining and is suitable for abnormal subsequence detection under electrocardiogram data. Background Art

[0002] In real life, various fields contain a large amount of time series data, such as patients' electrocardiogram data, electroencephalogram data, industrial sensor data, and network flow data. Time series data is data formed according to the order of data generation. Therefore, time series data records the fluctuation information of a certain action in the time dimension, and the abnormal subsequences that may be contained in time series data will contain more important information than most normal subsequences. For example, abnormal electrocardiogram data means that the patient may have a certain type of heart disease, and abnormal EEG data may be caused by brain diseases such as epilepsy; abnormal sequence data in industrial sensor data may mean that a machine in the factory has failed; abnormal traffic data in network flow data indicates that the system is under attack, etc. Abnormal subsequence (pattern) detection in time series is a very important field. Most of the time series data containing abnormal patterns appear in normal form, and the frequency of abnormal patterns is very low, but the rarely occurring abnormal patterns contain quite important information. Therefore, the research on abnormal subsequence detection of time series data is of great practical significance.

[0003] Domestic and foreign scholars have done a lot of work on the research of time series anomaly detection. Among them, there are algorithms based on supervised learning, such as: Junshui Ma proposed to use One-Class SVM to detect abnormal patterns of time series. The idea is that One-Class SVM can detect abnormal points in vector data sets. After the time series data is converted into phase space, the model is trained using positive training data. Finally, the trained model is used to detect whether the time series deviates from the model, so that the abnormal pattern of the time series can be detected. Based on unsupervised learning algorithms, for example: Izakian proposed to use fuzzy C-means clustering to detect abnormal subsequences of time series. The idea is to cluster the subsequences of the time series using the fuzzy C-means clustering method. The cluster center reflects the pattern structure of the time series. The original subsequence is reconstructed using the cluster center. The normal subsequence pattern structure can be well reconstructed through the cluster center, while the abnormal subsequence is difficult to reconstruct through the cluster center. The abnormal subsequence is found by comparing the difference between the subsequence reconstructed using the cluster center and the atomic sequence. Keogh proposed the HOT SAX method to discover abnormal subsequences in time series. This method converts the time series into SAX representation method and uses a heuristic pruning strategy method to reduce the similarity measurement calculation between time series subsequences, reducing the time complexity of the algorithm, thereby greatly improving the efficiency of abnormal subsequence detection in time series. Guiling proposed a new detection algorithm based on bit representation clustering. First, PAA was used to reduce the dimension of time series data. Then, an improved K-Medoids clustering algorithm was proposed to merge subsequences with similar changes. Finally, the binary bit method was used to represent the cluster center. Two pruning strategies were designed and an anomaly detection algorithm for time series was introduced. Ren et al. proposed a time series anomaly detection algorithm PAPR-RW based on PAPR representation and random walk model. The algorithm process is to use PAPR to represent the time series, then calculate the similarity matrix on the PAPR representation data, and input the similarity matrix into the RW model to evaluate the probability that each subsequence may be abnormal. Senin et al. proposed a time series anomaly detection algorithm based on syntax compression. It first discretizes the time series into symbolic data, then derives a context-free grammar and exploits its hierarchical structure to discover algorithmic irregularities related to anomalies.

[0004] In addition to the above-mentioned documents, some researchers have invented some patents in recent years to study the methods of measuring time series similarity. For example, in a patent document in 2017, the time series is segmented and these segments are formed into sets, and the Jaccard coefficient of the set is calculated to approximate the similarity of the original time series; in a patent document in 2015, after dividing the time series data into subsequences, the adaptive hierarchical clustering method is used to complete the anomaly detection method of satellite remote sensing data.

[0005] In supervised time series anomaly detection algorithms, a model is trained based on known data to detect anomalies in unknown data. However, in actual application areas, anomalies are often unknown, and there may be many different types of anomalies in the data. Therefore, supervised anomaly detection algorithms are often not used in real application scenarios.

[0006] In the unsupervised time series anomaly detection algorithm, the starting point is "few and different" to detect whether there are subsequences in the time series that do not conform to the distribution of most non-self-matching subsequences. This type of algorithm does not require known data and belongs to the machine learning algorithm of lazy learning. The current time series anomaly detection algorithms can be divided into: anomaly detection algorithms for original time series data; anomaly detection algorithms for other representation methods of time series. Among them, the anomaly detection algorithm for the original time series needs to calculate the similarity or distance between two time series. The commonly used methods for calculating similarity are Euclidean distance and cosine distance; in these methods of calculating similarity, only the similarity between time series of the same length can be calculated, and for time series with time drift, these calculation methods often cannot obtain good similarity calculation results. The method of calculating similarity in the field of speech (dynamic time warping) can solve the problem of time drift in processing time series; however, dynamic time warping requires a long time overhead in the process of calculating the similarity between time series. Secondly, for time series anomaly detection algorithms for other representation methods of time series, these anomaly detection algorithms are based on other representation methods of time series, such as SAX, PAA, and PAPR. These representation methods can reduce the representation dimension of time series to a certain extent, thus improving the efficiency of the algorithm. However, these methods not only ignore the information of time series in the time dimension, but also cannot solve the time drift problem of time series well. Summary of the invention

[0007] The purpose of the present invention is to provide a method for solving the above-mentioned technical problems.

[0008] In order to achieve the above object, the technical solution adopted by the present invention is:

[0009] A time series detection algorithm application, characterized by:

[0010] First, the local density of each data point in the subsequence in the dynamic time segment is evaluated to evaluate the abnormality of the base point, and then the abnormality of the subsequence is determined;

[0011] Definition 1: Dynamic time segment R; Dynamic time segment refers to the time window used to find the most similar data points, which is a continuous time segment in the subsequence, such as: t s ,t s+1 ,......,t e (e≤d,s≥1,s≤e);

[0012] Definition 2: Hash function hash(.),

[0013]

[0014] Where w is the hash function width parameter randomly and uniformly sampled from the range [1.0 / log2(N), 1-1.0 / log2(N)], and r is a parameter randomly selected from the range [0, w];

[0015] If two data points have the same hash value, it means that the two data points are similar data points; the data set at d time points can be Mapped to d hash tables middle;

[0016] Definition 3: A set of similar time points, assuming that there is a dynamic time segment R = t s ,..,t r ,...,t e The dataset corresponding to this fragment And the data points for which similar time points need to be calculated The hash table mapped by the hash function is Then the time series P at time t r The data point p on r , the set of similar time points on this dynamic time segment is:

[0017]

[0018] Definition 4: True similarity relation, in the dynamic time segment R = t s ~t e The random hash function is used to find the r The set of time points with similar relationships N(p r ). Due to the randomness of the hash function, the set N(p r ) may contain rIt is not a time point of true similarity; therefore, h random hash functions are defined for each dynamic time segment, and the h sets N(p r ), which is p r The set of true similar time points is as shown in Formula 3:

[0019] TN(p r )=N1(p r )∩N2(p r )∩.....∩N h (p r ) (3)

[0020] Definition 5: Local density, data point q i At time point t j The local density Pointing at The data point set and the data point q i The number of data points with similar relationships; as shown in Formula 4:

[0021]

[0022] Definition 6: Dynamic local density. Dynamic local density refers to the area containing data point q. i Evaluate the data point q in the dynamic time window corresponding to the time point i Local density; Estimation process: Find the segment R = t s ~t e The data points corresponding to the time points in the middle are related to q i There is a set of time points with true similarity, and then the data points corresponding to these time points are used to calculate q i The dynamic local density is as follows:

[0023]

[0024] Definition 7: Time partition tree TSTree; TSTree is used to partition the time range t1 to t d The process of TSTree dividing dynamic time segments is as follows: from t1 to t d Randomly select a time point st as the split point within the range; divide the time before st into T l , the time after st is divided into T r ; Recursively execute the above process until the following stopping condition is encountered:

[0025] (1) The length of the time segment contained in the node is less than or equal to 3;

[0026] (2) The depth of the tree is equal to log2(d);

[0027] Based on the above definition, time series detection can be divided into the following five steps:

[0028] (1) Constructing dynamic time segments

[0029] Dynamic density estimation is to evaluate the local density of a time point through dynamic time segments. The first step of the algorithm is to divide the time series into multiple non-overlapping time segments. The time series is divided into different segments in a random manner. The division method is shown in Definition 7. The division of dynamic time segments is completed by constructing TSTree. Each leaf node of TSTree contains a data set on a time segment.

[0030] (2) Building a hash table

[0031] After dividing the time series into different dynamic time segments based on TSTree, a hash function is needed to map the data in each time segment into a hash table so that the local density of data points can be quickly estimated;

[0032] First, generate h hash functions {hash1(.), hash2(.), ..., hash1(.), hash2(.), ..., hash2(.), hash1(.), hash2 ...2(.), hash1(.), hash2(.), h (.)}, the formula of the hash function is shown in Definition 2, h hash functions can map the values ​​on the leaf nodes into h hash tables {HashTable1, HashTable2, ..., HashTable h}; Each hash table HashTable j It is expressed in the form of a two-dimensional array. The width of the hash table is equal to the length of the time segment contained in the leaf node, and the length of each column in the hash table may be different. Each element in the hash table is stored in the form of Key-Value. The Key represents the hash value, and the Value represents the number of times this hash value appears in the data set.

[0033] In order to calculate the true similarity relationship of data points on leaf nodes, it is necessary to build h hash tables for each node; the process of building hash tables for other leaf nodes is similar to the above description;

[0034] (3) Calculate the dynamic local density of data points

[0035] Definition 6 describes the calculation of the data point p i The formula of dynamic local density is Density(p i ), dynamic local density estimation requires not only the dynamic time segment described in the previous step, but also the local density of Definition 5 and the true similarity relationship described in Definition 4;

[0036] The calculation of the dynamic local density of data points can be divided into the following process: first, query the dynamic time segment where the data point is located for the time point, and then calculate the true similarity set of this data point; finally, calculate the number of data points in the true similarity set that are similar to each time point;

[0037] (4) Calculate the local density of the subsequence to determine the abnormality of the subsequence

[0038] Step 3 completes the dynamic local density estimation of a data point; then the local density estimation of the subsequence P is shown in Formula 6, where d represents the length of the subsequence P, Density(p i ) represents the method described in Definition 6 for the data point p i The local density estimation of the subsequence P. If the value of Density(P) is larger, it means that the data points in the subsequence P have similar features with the data points of most non-self-matching subsequences in the data set. Therefore, the subsequence P is more likely to be a normal subsequence. If the value of Density(P) is smaller, it means that the subsequence P has fewer similar features with most other subsequences in the data set, and P is more likely to be an abnormal subsequence.

[0039]

[0040] (5) Determine the abnormality of subsequences through integration

[0041] Steps 1 to 4 evaluate the abnormality of each time series in the data set by dividing the subsequence into non-overlapping dynamic time segments. This process uses the data structure TSTree proposed in Definition 7. However, since TSTree divides time segments randomly, if there is only one TSTree in the algorithm, the algorithm will not obtain a relatively stable calculation result.

[0042] Adopting the idea of ​​ensemble learning, construct m TSTrees to form TSForest; using TSForest to calculate the score of subsequence P as the dynamic density mean of m TSTrees, the score calculation formula of the subsequence is shown in Formula 7; the smaller the Score(P), the more likely the subsequence P is an abnormal subsequence

[0043]

[0044] Due to the adoption of the above technical solution, the technical effects achieved by the present invention are as follows:

[0045] This technical solution is a time series abnormal subsequence detection algorithm based on dynamic local density (DLDE). This algorithm first evaluates the local density of each data point in the subsequence in the dynamic time segment to evaluate the abnormality of the base point, and then determines the abnormality of the subsequence. When processing data, this algorithm makes full use of the information of the time series in the time dimension, solves the time drift problem of the time series, and can ensure the accuracy and effectiveness of the data results. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart for calculating the dynamic local density of data points;

[0047] Figure 2 This is the experimental result of the chfdb_ch01_275 dataset on ECG1;

[0048] Figure 3 This is the experimental result of the chfdb_ch01_275 dataset on ECG2;

[0049] Figure 4 This is the experimental result of the chfdb_chf13_45590 dataset on ECG1;

[0050] Figure 5 This is the experimental result of the chfdb_chf13_45590 dataset on ECG1. DETAILED DESCRIPTION

[0051] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0052] This paper proposes a time series abnormal subsequence detection algorithm based on dynamic local density estimation (DLDE). The invention belongs to the technology of data mining and is suitable for abnormal subsequence detection in electrocardiogram data.

[0053] This algorithm first evaluates the local density of each data point in the subsequence in the dynamic time segment to evaluate the abnormality of the base point, and then determines the abnormality of the subsequence. The symbols and their descriptions in the description of the DLDE algorithm are shown in Table 1.

[0054] Table 1 Symbols

[0055]

[0056]

[0057] Before describing the detailed process of the DLDE algorithm, we first introduce the definitions needed by the DLDE algorithm:

[0058] Definition 1: Dynamic time segment R. A dynamic time segment refers to a time window used to find the most similar data points, which is a continuous time segment in a subsequence, such as: t s ,t s+1 ,......,t e (e≤d,s≥1,s≤e).

[0059] Definition 2: Hash function hash(.).

[0060]

[0061] Among them, w is the hash function width parameter randomly and uniformly sampled from the range [1.0 / log2(N), 1-1.0 / log2(N)], and r is a parameter randomly selected from the range [0, w].

[0062] If two data points have the same hash value, it means that the two data points are similar. The hash function can be used to convert the data set at d time points into Mapped to d hash tables middle.

[0063] Definition 3: Similar time point set. Assume that there is a dynamic time segment R = t s ,..,t r ,...,t e The dataset corresponding to this fragment And the data points for which similar time points need to be calculated The hash table mapped by the hash function is Then the time series P at time t r The data point p on r , the set of similar time points on this dynamic time segment is:

[0064]

[0065] Definition 4 True similarity relation. In the dynamic time segment R = t s ~t e The random hash function is used to find the r The set of time points with similar relationships N(p r ). Due to the randomness of the hash function, the set N(p r ) may contain rTherefore, h random hash functions are defined for each dynamic time segment, and the h sets N(p r ), which is p r The set of true similar time points is as shown in Formula 3:

[0066] TN(p r )=N1(p r )∩N2(p r )∩.....∩N h (p r ) (3)

[0067] Definition 5: Local density. Data point q i At time point t j The local density Pointing at The data point set and the data point q i The number of data points with similar relationships. As shown in Formula 4:

[0068]

[0069] Definition 6: Dynamic local density. Dynamic local density refers to the area containing data point q i Evaluate the data point q in the dynamic time window corresponding to the time point i The local density of . Estimation process: Find the segment R = t s ~t e The data points corresponding to the time points in the middle are related to q i There is a set of time points with true similarity, and then the data points corresponding to these time points are used to calculate q i The dynamic local density is as follows:

[0070]

[0071] Definition 7 Time Split Tree (TSTree). TSTree is used to divide the time range t1 to t d The process of TSTree dividing dynamic time segments is as follows: from t1 to t d Randomly select a time point st as the split point within the range; divide the time before st into T l , the time after st is divided into T r ; Recursively execute the above process until the following stopping condition is encountered:

[0072] (1) The length of the time segment contained in the node is less than or equal to 3;

[0073] (2) The depth of the tree is equal to log2(d).

[0074] Based on the above definition, the detailed description of the DLDE algorithm can be divided into the following five steps:

[0075] (1) Constructing dynamic time segments

[0076] Dynamic density estimation evaluates the local density of a time point through dynamic time segments. Therefore, the first step of the algorithm is to divide the time series into multiple non-overlapping time segments. The time series is divided into different segments in a random manner as shown in Definition 7. The division of dynamic time segments is completed by constructing TSTree. Each leaf node of TSTree contains a data set on a time segment.

[0077] (2) Building a hash table

[0078] After dividing the time series into different dynamic time segments based on TSTree, a hash function is needed to map the data in each time segment into a hash table so that the local density of data points can be quickly estimated. First, h hash functions {hash1(.), hash2(.), ..., hash2(.), ..., hash1(.), ..., ... h (.)}, the formula of the hash function is shown in Definition 2, h hash functions can map the values ​​on the leaf nodes into h hash tables {HashTable1, HashTable2, ..., HashTable h}. Each hash table HashTable j It is expressed in the form of a two-dimensional array. The width of the hash table is equal to the length of the time segment contained in the leaf node, and the length of each column in the hash table may be different. Each element in the hash table is stored in the form of Key-Value, where Key represents the hash value and Value represents the number of times this hash value appears in the data set.

[0079] In order to calculate the true similarity relationship of data points on leaf nodes, it is necessary to build h hash tables for each node. The process of building hash tables for other leaf nodes is similar to the above description.

[0080] (3) Calculate the dynamic local density of data points

[0081] Definition 6 describes the calculation of the data point p i The formula of dynamic local density is Density(p i), dynamic local density estimation requires not only the dynamic time segment described in the previous step, the local density of Definition 5, and the true similarity relationship described in Definition 4. The calculation of the dynamic local density of a data point can be divided into the following process: first, query the dynamic time segment where the data point is located for the time point, and then calculate the true similarity set of this data point; finally, calculate the number of data points in the true similarity set that are similar to each time point. For details, see Figure 1 .

[0082] (4) Calculate the local density of the subsequence to determine the abnormality of the subsequence

[0083] Step 3 completes the dynamic local density estimation of a data point; then the local density estimation of the subsequence P is shown in Formula 6, where d represents the length of the subsequence P, Density(p i ) represents the method described in Definition 6 for the data point p i The local density estimate of . If the value of Density(P) is larger, it means that the data points in subsequence P have similar features to the data points of most non-self-matching subsequences in the data set. Therefore, subsequence P is more likely to be a normal subsequence. If the value of Density(P) is smaller, it means that subsequence P has fewer similar features to most other subsequences in the data set, and P is more likely to be an abnormal subsequence.

[0084]

[0085] (5) Determine the anomaly of the subsequence through integration

[0086] Steps 1 to 4 evaluate the abnormality of each time series in the data set by dividing the subsequence into non-overlapping dynamic time segments. This process uses the data structure TSTree proposed in Definition 7. However, since TSTree divides time segments randomly, if there is only one TSTree in the algorithm, the algorithm will not obtain a relatively stable calculation result. Therefore, it is proposed to use the idea of ​​ensemble learning to construct m TSTrees to form TSForest. The score of the subsequence P calculated by TSForest is the dynamic density mean evaluated by m TSTrees, so the score calculation formula of the subsequence is shown in Formula 7. The smaller the Score(P), the more likely the subsequence P is an abnormal subsequence.

[0087]

[0088] In order to verify the effectiveness of the proposed algorithm, two data sets were selected from the MIT-BIH database (as shown in Table 2), and these three data sets are also included in the UCR data set. In the embodiment, 15 seconds of data from each of the three data sets are used as experimental data, and the entire time series is divided into 15 sub-time series according to the period of one second.

[0089] The chfdb_ch01_275 dataset is selected using the BIDMC dataset, with each subsequence length of 250 and 1 subsequence containing abnormal points. This sequence contains two ECG signals. The chfdb_chf13_45990 dataset is also selected using the BIDMC dataset, with each subsequence length of 250. The length of the mitdbx_108 dataset is 5400 data points, with 360 data points per second.

[0090] Abnormal ECG data points in time series have been annotated in MIT-BIH. The difference between the scores of subsequences containing abnormal ECG data points calculated by the method proposed in this topic and other normal subsequences will be verified, and this difference will be visualized in a line graph.

[0091] Table 2 Experimental dataset

[0092]

[0093] Since the result calculated by the proposed method is the density score of the subsequence in the time series dataset, the score can be converted into the anomaly score of the subsequence by formula 8.

[0094]

[0095] The BIDMC database includes long-term ECG recordings of 15 subjects with severe congestive heart failure (NYHA class 3-4). This group of subjects was part of a larger study group that received conventional medical therapy before receiving oral inotropic drugs. Each recording contains two ECG signals, each with a sampling rate of 250 samples per second, 12 resolution, and an error range of ±10 mV.

[0096] (1)chfdb_ch01_275

[0097] This data set is the 01 record data set of BIDMC, which contains two ECG signals ECG1 and ECG2. This experiment selects 15 seconds of ECG data from the 01 record. The 15 seconds of ECG data contains an abnormal ECG data of ventricular premature beat. Figure 2 Shown are the experimental results on ECG1 under this dataset.

[0098] The proposed method is used to detect the periodic ECG data (one cycle per second) containing ventricular premature beat data. The experimental results are as follows: Figure 2 and Figure 3 shown. Figure 2The experimental results recorded on the signal ECG1, sub-graph (a) indicates the original time series, and sub-graph (b) indicates the score calculated by the DLDE algorithm, which is converted into anomaly scores by formula 8. From these two sub-graphs, we can clearly see the difference in scores on each sub-sequence. Except for the sub-sequence marked in red with a higher anomaly score, the scores of other sub-sequences are smaller and relatively close. Figure 3 The experimental results recorded on the signal ECG2 show that in the ECG data, each subsequence time has different degrees of difference. The score on each subsequence fluctuates to a certain extent, but the subsequences of ECG data with severe abnormalities can still be clearly found; in this data set, if the abnormal scores of the subsequences are sorted to find abnormal subsequences (abnormal ECG signals), there will be no missed detections. This proves the effectiveness of the proposed algorithm on this data set. Figure 3 Shown are the experimental results on ECG2 under this dataset.

[0099] (2)chfdb_chf13_45590

[0100] This data set is the 13th record in the BIDMC data set. This record also contains two ECG signals ECG1 and ECG2. This experiment selected 15 seconds of data from this data set, among which the data in the 12th second contains abnormal ECG signals. Figure 4 Shown are the experimental results on ECG1 under this dataset.

[0101] The proposed anomaly detection algorithm DLDE is used to calculate the fraction of each cycle of ECG data in this ECG segment (the data per second is one ECG cycle data). The experimental results are as follows Figure 4 and Figure 5 shown. Figure 4 The experimental results recorded on ECG1, the broken line of sub-graph (a) represents the original time series, and it can be intuitively observed that the ECG data of a cycle marked in red is obviously different from other ECG cycle data; sub-graph (b) shows the abnormal score calculated by the DLDE algorithm, and the score of the ECG cycle data marked in red is significantly higher than that of other ECG cycle data. Therefore, the proposed DLDE anomaly detection algorithm can detect this abnormal ECG cycle data. Figure 5 The experimental results on ECG2 signal are recorded. The two broken lines in the figure are the same. Figure 3 Similarly, the detection results of the ECG data on this signal can also illustrate the effectiveness of the anomaly detection algorithm DLDE proposed in this project. Figure 5 Shown are the experimental results on ECG2 under this dataset.

[0102] The above two embodiments prove the effectiveness of the algorithm.

[0103] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An application of a time series detection algorithm, characterized in that: First, the local density of each data point in the subsequence in the dynamic time segment is evaluated to evaluate the abnormality of the base point, and then the abnormality of the subsequence is determined; Definition 1: Dynamic time segment R; Dynamic time segment refers to the time window used to find the most similar data points, which is a continuous time segment in the subsequence, such as: t s ,t s+1 ,......,t e (e≤d,s≥1,s≤e); Definition 2: Hash function hash(.), Where w is the hash function width parameter randomly and uniformly sampled from the range [1.0 / log2(N), 1-1.0 / log2(N)], and r is a parameter randomly selected from the range [0, w]; If two data points have the same hash value, it means that the two data points are similar data points; the data set at d time points can be Mapped to d hash tables middle; Definition 3: A set of similar time points, assuming that there is a dynamic time segment R = t s ,..,t r ,...,t e The dataset corresponding to this fragment And the data points for which similar time points need to be calculated The hash table mapped by the hash function is Then the time series P at time t r The data point p on r , the set of similar time points on this dynamic time segment is: Definition 4: True similarity relation, in the dynamic time segment R = t s ~t e The random hash function is used to find the r The set of time points with similar relationships N(p r ). Due to the randomness of the hash function, the set N(p r ) may contain r It is not a time point of true similarity; therefore, h random hash functions are defined for each dynamic time segment, and the h sets N(p r ), which is p r The set of true similar time points is as shown in Formula 3: TN (p r )=N1(p r )∩N2(p r )∩.....∩N h (p r ) (3) Definition 5: Local density, data point q i At time point t j The local density Pointing at The data point set and the data point q i The number of data points with similar relationships; as shown in Formula 4: Definition 6: Dynamic local density. Dynamic local density refers to the area containing data point q. i Evaluate the data point q in the dynamic time window corresponding to the time point i Local density; Estimation process: Find the segment R = t s ~t e The data points corresponding to the time points in the middle are related to q i There is a set of time points with true similarity, and then the data points corresponding to these time points are used to calculate q i The dynamic local density is as follows: Definition 7: Time partition tree TSTree; TSTree is used to partition the time range t1 to t d The process of TSTree dividing dynamic time segments is as follows: from t1 to t d Randomly select a time point st as the split point within the range; divide the time before st into T l , the time after st is divided into T r ; Recursively execute the above process until the following stopping condition is encountered: (1) The length of the time segment contained in the node is less than or equal to 3; (2) The depth of the tree is equal to log2(d); Based on the above definition, time series detection can be divided into the following five steps: (1) Constructing dynamic time segments Dynamic density estimation is to evaluate the local density of a time point through dynamic time segments. The first step of the algorithm is to divide the time series into multiple non-overlapping time segments. The time series is divided into different segments in a random manner. The division method is shown in Definition 7. The division of dynamic time segments is completed by constructing TSTree. Each leaf node of TSTree contains a data set on a time segment. (2) Building a hash table After dividing the time series into different dynamic time segments based on TSTree, a hash function is needed to map the data in each time segment into a hash table so that the local density of data points can be quickly estimated; First, generate h hash functions {hash1(.), hash2(.), ..., hash1(.), hash2(.), ..., hash2(.), hash1(.), hash2 ...2(.), hash1(.), hash2(.), h (.)}, the formula of the hash function is shown in Definition 2, h hash functions can map the values ​​on the leaf nodes into h hash tables {HashTable1, HashTable2, ..., HashTable h }; Each hash table HashTable j It is expressed in the form of a two-dimensional array. The width of the hash table is equal to the length of the time segment contained in the leaf node, and the length of each column in the hash table may be different. Each element in the hash table is stored in the form of Key-Value. The Key represents the hash value, and the Value represents the number of times this hash value appears in the data set. In order to calculate the true similarity relationship of data points on leaf nodes, it is necessary to build h hash tables for each node; the process of building hash tables for other leaf nodes is similar to the above description; (3) Calculate the dynamic local density of data points Definition 6 describes the calculation of the data point p i The formula of dynamic local density is Density(p i ), dynamic local density estimation requires not only the dynamic time segment described in the previous step, but also the local density of Definition 5 and the true similarity relationship described in Definition 4; The calculation of the dynamic local density of data points can be divided into the following process: first, query the dynamic time segment where the data point is located for the time point, and then calculate the true similarity set of this data point; finally, calculate the number of data points in the true similarity set that are similar to each time point; (4) Calculate the local density of the subsequence to determine the abnormality of the subsequence Step 3 completes the dynamic local density estimation of a data point; then the local density estimation of the subsequence P is shown in Formula 6, where d represents the length of the subsequence P, Density(p i ) represents the method described in Definition 6 for the data point p i The local density estimation of the subsequence P. If the value of Density(P) is larger, it means that the data points in the subsequence P have similar features with the data points of most non-self-matching subsequences in the data set. Therefore, the subsequence P is more likely to be a normal subsequence. If the value of Density(P) is smaller, it means that the subsequence P has fewer similar features with most other subsequences in the data set, and P is more likely to be an abnormal subsequence. (5) Determine the anomaly of the subsequence through integration Steps 1 to 4 evaluate the abnormality of each time series in the data set by dividing the subsequence into non-overlapping dynamic time segments. This process uses the data structure TSTree proposed in Definition 7. However, since TSTree divides time segments randomly, if there is only one TSTree in the algorithm, the algorithm will not obtain a relatively stable calculation result. Adopting the idea of ​​ensemble learning, construct m TSTrees to form TSForest; using TSForest to calculate the score of subsequence P as the dynamic density mean of m TSTrees, the score calculation formula of the subsequence is shown in Formula 7; the smaller the Score(P), the more likely the subsequence P is an abnormal subsequence

Images