VAE and association difference-based multivariate time series data anomaly detection method

Abstract

The invention discloses a multivariate time series data anomaly detection method based on VAE and association difference, which enables a model to effectively capture the anomaly change essence in a time series by introducing the association difference, and enables the model to quantify the change of the association degree between variables through the calculation of the association difference, thereby more accurately distinguishing the normal state from the abnormal state. Meanwhile, the time sequence is reconstructed by using a variational auto-encoder, so that the distribution rule of the data can be learned, and the factor which can best represent the essential characteristics of the data can be found out. And the association difference of the reconstructed time sequence is further learned, so that the anomaly distinguishing capability of the model is enhanced and generalized. In addition, the mean square error, the KL divergence and the correlation difference are combined to serve as the abnormity judgment standard, and the abnormity detection capacity of the model is greatly improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data anomaly detection, and specifically relates to a multivariate time series data anomaly detection method based on VAE and correlation difference. Background Art

[0002] With the rapid development of industrial automation, Internet of Things, big data and artificial intelligence technology, time series data is increasingly used in various fields such as industrial equipment monitoring, spacecraft status detection, network security, financial fraud detection, medical monitoring, etc. These data often reflect the system status in the form of continuous time series, and its anomaly detection is of vital importance to ensure system security, improve operation efficiency and reduce maintenance costs. However, when facing massive, high-dimensional, nonlinear and dynamically changing time series data, traditional anomaly detection methods have many problems such as low detection accuracy, insufficient robustness and poor real-time performance.

[0003] Traditional statistical methods were the first to be applied to time series anomaly detection. For example, the autoregressive integrated moving average (ARIMA) model predicts future data and detects anomalies in prediction errors by modeling autocorrelation, trend, and seasonality in time series. Although the ARIMA model can capture linear relationships when the data is stationary and has obvious periodicity, it has high requirements for data stationarity and cannot effectively deal with nonlinear changes and sudden anomalies. It is also easily limited when dealing with long-term dependencies. On the other hand, models based on probability distribution, such as the Gaussian mixture model (GMM), assume that data is a mixture of multiple Gaussian distributions, and calculate the probability of data points through parameter estimation to determine anomalies; however, GMM often faces the problem of difficulty in determining the number of Gaussian distributions and high computational complexity in high-dimensional data processing and multimodal data scenarios, which limits its application effect in complex dynamic systems.

[0004] In recent years, with the continuous development of machine learning and deep learning technologies, researchers have begun to try to introduce support vector machines (SVM), decision trees, random forests and other methods to model time series anomaly detection. SVM distinguishes abnormal and normal data by constructing the optimal classification hyperplane. Although it performs well in small samples and nonlinear scenarios, its performance is highly dependent on the selection of kernel functions and parameter tuning, and there is a computational bottleneck in large-scale data processing; random forests and other ensemble learning methods improve detection robustness by integrating multiple decision trees, but when the data features are more complex or there is more noise, overfitting is prone to occur, which in turn affects the detection effect. Although these methods have improved the performance of anomaly detection to a certain extent, they are still insufficient in capturing long-term dependencies, local dynamic changes and global distribution characteristics in time series.

[0005] Deep learning methods have made great progress in the field of anomaly detection in recent years. Recurrent neural networks (RNNs) and their improved forms such as long short-term memory networks (LSTMs) and gated recurrent units (GRUs) are widely used in time series data analysis. They can capture long-term dependencies in sequences through internal memory units and achieve anomaly detection through sequence prediction. However, RNNs and their variants often suffer from gradient vanishing or gradient explosion problems when processing very long sequences. At the same time, due to their sequential processing characteristics, the training and reasoning efficiency of the model is low. Although convolutional neural networks (CNNs) are outstanding in automatically extracting local features, they are not capable of modeling long-distance dependencies and are difficult to fully reflect the complex dynamic patterns in time series. In addition, some anomaly detection methods based on generative adversarial networks (GANs) have also been proposed, but these methods often focus on generating high-quality reconstructed images or sequences, and there is no unified and robust indicator for the judgment criteria of anomaly detection.

[0006] In the above context, some studies have begun to explore anomaly detection methods based on variational autoencoders (VAEs) in recent years. VAEs can learn the potential probability distribution of input data by introducing latent variables and using the maximum evidence lower bound (ELBO) for parameter estimation, thereby generating anomaly reconstruction errors that are significantly different from the original data during the reconstruction process. Although VAE has a great advantage in capturing the global distribution characteristics of data, when relying solely on reconstruction errors for anomaly judgment, it often ignores the local temporal dependencies and dynamic change characteristics in time series data, which may lead to less than ideal detection accuracy when the data anomalies are more hidden or the local anomaly fluctuations are small. Summary of the invention

[0007] In view of the above, the present invention provides a multivariate time series data anomaly detection method based on VAE and association differences. The method comprehensively utilizes the global distribution learning ability of VAE and the local dependency capture ability of the self-attention mechanism as well as the anomaly judgment method based on association differences, which significantly improves the detection accuracy and robustness.

[0008] A multivariate time series data anomaly detection method based on VAE and correlation difference includes the following steps: (1) Obtain multivariate time series data and preprocess it to obtain a clean dataset suitable for model training, and then divide the dataset into a training set and a test set; (2) Establish an anomaly detection model based on VAE and associated difference mechanism, which includes: The correlation difference module is used to capture the time dependency in multivariate time series data and calculate the correlation difference of multivariate time series data as part of the anomaly detection metric; The reconstruction module is used to map the feature vector output by the correlation difference module to the latent space to capture its potential features, and then randomly sample in the latent space to obtain the reconstructed time series data; The random correlation difference module is used to capture the time dependency in the reconstructed time series data and calculate the correlation difference of the reconstructed time series data to further improve the anomaly detection and recognition ability of the model; (3) Use the multivariate time series data of the training set to train the above model, and use the reconstruction error and association difference loss as the objectives of model training; (4) Input the multivariate time series data of the test set into the trained model to obtain the corresponding association difference, and calculate the anomaly score of each time point in the multivariate time series data based on the association difference and reconstruction error; (5) Compare the anomaly score of each time point in the multivariate time series data with the set threshold. If it exceeds the threshold, it is judged as an anomaly, thereby identifying the abnormal time points in the multivariate time series data.

[0009] Furthermore, the preprocessing of multivariate time series data in step (1) includes denoising, normalization and missing value filling.

[0010] Furthermore, the multivariate time series data needs to be positionally encoded before being input into the model, that is, the multivariate time series data and the position encoding vector generated based on the sine and cosine functions are added element-wise to encode the sequential information in the data; this approach ensures that the model can understand the relative position of each element in the sequence.

[0011] Furthermore, the association difference module is composed of a plurality of association difference layers in cascade, wherein the association difference layer firstly processes the input x through Anomaly-Attention, then adds the output of Anomaly-Attention to the input x and inputs it into the feedforward neural network after layer normalization, and finally adds the input and output of the feedforward neural network and processes it as the output of the association difference layer after layer normalization.

[0012] Furthermore, the reconstruction module first uses a dimensionality reduction convolution layer to map the feature vector output by the associated difference module to the latent space to fit the mean and variance of the approximate posterior distribution of the latent variable, thereby obtaining the approximate posterior distribution of the latent variable, that is, the latent feature, and then uses a dimensionality increase convolution layer to randomly sample in the latent space using the reparameterization technology to obtain the final latent variable as the reconstructed time series data.

[0013] Furthermore, the random association difference module is composed of a plurality of random association difference layers in cascade, wherein the random association difference layer firstly processes the input x' through Anomaly-Attention, then adds the output of Anomaly-Attention to the input x' and inputs the result into the feedforward neural network after layer normalization, and finally adds the input and output of the feedforward neural network and inputs the result into the fully connected layer after layer normalization, and the output of the fully connected layer is used as the output of the random association difference layer.

[0014] Furthermore, in step (4), the anomaly score of each time point in the multivariate time series data is calculated by the following formula;

[0015] Where: X represents multivariate time series data, Represents the reconstruction of time series data, is the anomaly score sequence of X, and each element value in the sequence corresponds to the anomaly score at each time point in the multivariate time series data; AssDis(P,S;X) is the association difference of the multivariate time series data X, To reconstruct time series data The reconstruction error consists of two parts, namely X and The mean square error and KL divergence KLD, represents element-wise multiplication, and Softmax( ) represents the Softmax function.

[0016] Furthermore, the expression of the association difference AssDis(P, S; X) is as follows:

[0017] in: express Relative to The KL divergence of express Relative to The KL divergence of , L is the number of layers of the associated difference module, Represents the prior correlation matrix P l The distribution of the i-th row in , Represents the sequence correlation matrix S l The distribution of the i-th row in , where N is the sequence length of the multivariate time series data.

[0018] Furthermore, the prior correlation matrix P l and the sequence correlation matrix S l The expression is as follows:

[0019]

[0020] Among them: Q, K, σ are query vector matrix, key vector matrix, and scale parameter matrix respectively. , , , X l is the output of the lth layer in the associated difference module input to the multivariate time series data X, , , They correspond to the weight parameter matrices of Q, K, and σ at the lth layer, σ i is the value of the i-th element in the scale parameter matrix σ, d model For X l The characteristic dimension of T Represents transpose, and Rescale() represents a rescaling operation.

[0021] The association difference The calculation method is the same as AssDis(P,S;X), that is, replace the input X with the reconstructed time series data That's it.

[0022] Furthermore, the threshold in step (5) is automatically set using a super-threshold model based on extreme value theory. The super-threshold model derives the area exceeding the threshold by fitting the extreme value probability distribution of the abnormal score sequence, and deduces that its tail distribution approximately converges to a generalized Pareto distribution function according to the Pickands theorem, thereby determining the optimal threshold.

[0023] The anomaly detection model of the present invention is based on VAE and associated difference mechanism. It combines variational autoencoder and uses maximizing evidence lower bound (ELBO) to estimate the probability distribution of input data. The reparameterization technique is used to perform random sampling in the latent space to obtain reconstructed time series data. The difference between abnormal points and normal points in the reconstructed time series data will be further expanded. Learning associated differences for the reconstructed time series data can enhance the ability of associated differences to identify abnormal points. The randomness of the VAE reconstruction process will greatly improve the robustness and performance of the model.

[0024] The anomaly score calculation in the present invention combines reconstruction error and association difference to identify anomalies; the reconstruction error includes mean square error and KL divergence, which can reflect the model's ability to reconstruct time series, while the association difference quantifies the difference between prior association and sequence association, helping to distinguish normal and abnormal data points. Sequence association is used to represent the association distribution between time points in a time series, providing rich contextual information for capturing the dynamic characteristics of the sequence (such as periodicity and trend); prior association reflects the strong correlation that may exist between adjacent or nearby time points through a priori assumptions about the relative positions of time points in a time series; anomalies usually have smaller association differences, that is, the gap between their prior association and sequence association is smaller.

[0025] Therefore, the present invention has the following beneficial technical effects: 1. This paper effectively captures the key features of time series through the self-attention mechanism, and uses the dual indicators of correlation difference and reconstruction error to more accurately identify outliers and improve detection accuracy; compared with existing methods, it performs better on multiple public data sets.

[0026] 2. The present invention avoids the gradient explosion problem and the low efficiency of sequential processing in traditional prediction-based methods, improves the detection speed, and enhances the detection efficiency.

[0027] 3. The present invention cleverly uses the prior distribution of latent variables introduced by VAE to enable the model to work stably in complex dynamic environments, reduce misjudgments, and improve model robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Schematic diagram of the workflow of the multivariate time series data anomaly detection method based on VAE and correlation differences in the present invention.

[0029] Figure 2 Schematic diagram of the model structure based on VAE and associated difference mechanism of the present invention.

[0030] Figure 3 This is a schematic diagram of the visualization results obtained by model detection of the test set data of the present invention. DETAILED DESCRIPTION

[0031] In order to describe the present invention more specifically, the technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0032] As shown in FIG1 , the multivariate time series data anomaly detection method based on VAE and correlation difference of the present invention includes the following steps: (1) Data preprocessing: Preprocess the multivariate time series data, including denoising, normalization, and missing value filling, to obtain a clean data set suitable for model training. The collected time series data may contain noise due to sensor errors, transmission interference, and other factors. This embodiment uses a wavelet transform denoising method. This method is based on wavelet analysis theory and decomposes the time series data into subsequences of different frequencies. By setting a suitable threshold, the noise components in the high-frequency subsequence are suppressed or removed, and the main signal features contained in the low-frequency part are retained, thereby achieving the purpose of denoising. In order to eliminate the dimensional differences between different feature data and enable the model to learn and converge better, this embodiment uses the minimum-maximum normalization method. For the data of each feature dimension, x , calculate its minimum value min and maximum value max , through the formula Map the data to the interval [0, 1] 。

[0033] (2) Model construction: The network structure of the anomaly detection model VAE-Anomaly of the present invention is as follows Figure 2 As shown in Figure 1, for the input of multidimensional time series data, the input vector is first element-wise added to the position encoding vector generated based on the sine and cosine functions to encode the order information in the data. This approach ensures that the model can understand the relative position of each element in the sequence. The final input is represented as X, which not only contains the time information of each time point, but also encodes its position information in the sequence.

[0034] Assume that the association difference module contains L layers, and the input sequence , where N is the length of the sequence and D is the feature dimension at each time point. The operation of the Lth layer can be expressed as:

[0035]

[0036] in: , l∈{1,2,…,L}, represents the output of the Lth layer, d model is the feature dimension of each layer, X 0 is the position-encoded input X, and It is the intermediate state of the Lth layer.

[0037] The Anomaly-Attention module is used to calculate the association difference. In the Anomaly-Attention module of each association difference layer, four important matrices are defined: the query vector matrix Q, the key vector matrix K, the value vector matrix V, and the scale parameter matrix σ. These matrices are calculated as follows:

[0038]

[0039]

[0040]

[0041] in: ,and , is the parameter matrix of the Lth layer, belonging to ,and .

[0042] For the L-th layer prior correlation matrix P l , and its calculation formula is:

[0043] Where: Prior correlation matrix is the scale parameter obtained based on learning Generated, the i-th element in the matrix The scale value corresponding to the i-th time point. By using the Rescale operation, the obtained association weights are divided by the sum of each row, thus converting them into a normalized discrete distribution P l , so that the sum of the elements in each row is 1.

[0044] At the same time, the sequence correlation matrix S l By calculating the inner product of the query vector Q and the key vector K and normalizing it through the Softmax function, the formula is as follows:

[0045] in: Represents the association matrix of the sequence. The Softmax operation is normalized in the last dimension, so S l Each row of constitutes a discrete distribution, representing the association weight of each time point with other time points.

[0046] By S l The product of the sum vector matrix V can get the output feature vector e of this layer. l :

[0047] in: It is the feature representation of the input time series after deep encoding, which contains the contextual information and long-term dependencies of the time series.

[0048] The association difference (AssDis) represents the symmetric KL divergence between the prior association and the sequence association, which measures the information gain between the two distributions. In order to calculate the overall association difference, the association differences from multiple layers need to be averaged; specifically, the calculation formula of the association difference is:

[0049] Among them: KL divergence measures the difference between two discrete distributions. For each layer l, P l and S l is the matrix of prior correlation and serial correlation, and They represent the distribution of the i-th row respectively.

[0050] final, is a vector of N elements, each of which represents the associated difference at the corresponding time point in the time series.

[0051] The associated difference module outputs the feature vector e l After that, the dimensionality reduction convolution layer is used to fit the hidden variable Z to approximate the mean μ and variance σ of the posterior distribution 2 , we get the approximate posterior distribution of Z This process can be regarded as finding a regular path in the high-dimensional data space, so that different feature vectors have a structured distribution representation in the latent space. Finally, the dimensionality-enhanced convolutional layer is used to obtain The final latent variable Z is sampled using the reparameterization technique.

[0052] In the random correlation difference layer, the model can effectively extract the correlation differences between different time points in the time series by learning the time series data reconstructed by the reconstruction module. Since the reconstruction process can restore the potential characteristics of the original data and introduce a certain degree of randomness to each data point, the difference between abnormal data points and normal data points becomes more obvious in the reconstructed data. By calculating these differences, the correlation difference mechanism can effectively distinguish between abnormal and normal states within a smaller error range. In addition, the randomness in the reconstruction process not only enhances the model's ability to generalize data, but also by learning diverse samples, the model can show higher flexibility and robustness in dealing with different types of anomalies. This mechanism helps the model better capture the data distribution characteristics in the time series, especially in the face of complex and dynamic environments, and can effectively identify potential abnormal patterns and improve the accuracy of anomaly detection.

[0053] (3) Calculation of anomaly scores.

[0054] The present invention uses reconstruction error and associated difference loss as the objectives of model training. The reconstruction error includes mean square error and KL divergence. The final anomaly score is calculated as follows:

[0055] in: represents element-wise multiplication, MSE and KLD represent the mean square error and KL divergence of the point respectively.

[0056] (4) Threshold setting.

[0057] After obtaining the anomaly score at each time point, a threshold needs to be set to determine whether an anomaly occurs. Anomaly scores exceeding the threshold will be classified as anomalies. The present invention uses an over-threshold model (POT) based on extreme value theory (EVT) to automatically set the optimal threshold. The model derives the area exceeding the threshold by fitting the extreme value probability distribution of the anomaly score sequence, and deduces that its tail distribution approximately converges to the generalized Pareto distribution function (GPD) according to the Pickands theorem.

[0058] (5) Anomaly detection

[0059] The final threshold th is obtained F Finally, the present invention marks the anomaly by judging whether the anomaly score is higher than the threshold. Specifically, the judgment rules of anomaly points and normal points are as follows:

[0060] In order to evaluate the anomaly detection model (VAE-Anomaly) proposed in the present invention, this embodiment selects five representative benchmark data sets from real-world application scenarios for experiments. And the performance of the model of the present invention is compared with the following advanced benchmark models: LSTM-VAE (Long Short-Term Memory Network Variational Autoencoder), AnomalyTransformer (Anomaly Detection Transformer), DCdetector (Dual Attention Contrast Detector), OmniAnomaly (Multivariate Time Series Omnipotent Anomaly Detector), InterFusion (Multivariate Time Series Fusion Anomaly Detector), DAGMM (Deep Auto-Encoding Gaussian Mixture Model), and the comparative experimental results are shown in Table 1. Overall, the average F1 score of the model of the present invention on the five data sets is 1.076% higher than that of the baseline method DCdetector. This result fully demonstrates the good generalization ability and effectiveness of the model of the present invention in complex environments with large differences in different abnormal data distributions and variables.

[0061] Table 1

[0062] In order to better demonstrate the effectiveness of correlation differences and reconstruction errors in time series modeling, this paper selects some test data from the SMD dataset for visual analysis. Figure 3The fluctuations of different sequences in the test set are shown. The three sequences are the correlation difference, the reconstructed sequence and the real original sequence. The abnormal points are marked in the red box. It can be clearly seen from the figure that the correlation difference value corresponding to the abnormal point in the original sequence is significantly lower than the normal point, while the reconstruction error shows a significant increase near the abnormal point. This shows that the correlation difference mechanism can effectively capture the change in the correlation between normal and abnormal states in the time series, and the correlation difference of the abnormal point has significant differentiation characteristics compared with the normal point. At the same time, the reconstruction error fluctuates greatly at the abnormal point, which further proves that the reconstruction module can accurately reflect the abnormal characteristics in the data. Combining these two metrics, the model of the present invention can more effectively distinguish abnormal points from normal points, improving the accuracy of anomaly detection.

[0063] Figure 3 The stability of the reconstructed sequence is shown below. Despite small fluctuations in the original data, the reconstructed sequence can still maintain a relatively stable trend. This feature shows that through the learning of the reconstruction module, the model of the present invention can capture the global trend in the time series and avoid misjudgment or overreaction caused by small fluctuations, effectively reducing the false alarm rate. In summary, the present invention combines the dual judgment mechanism of correlation difference and reconstruction error, so that the model shows higher sensitivity and robustness when facing local fluctuations and sudden anomalies in time series data, thereby having better performance in complex anomaly detection tasks.

[0064] The above description of the embodiments is to facilitate the understanding and application of the present invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments. Improvements and modifications made by those skilled in the art to the present invention based on the disclosure of the present invention should be within the protection scope of the present invention.

Claims

1. A multivariate time series data anomaly detection method based on VAE and correlation difference, comprising the following steps: (1) Obtain multivariate time series data and preprocess it to obtain a clean dataset suitable for model training, and then divide the dataset into a training set and a test set; (2) Establish an anomaly detection model based on VAE and associated difference mechanism, which includes: The correlation difference module is used to capture the time dependency in multivariate time series data and calculate the correlation difference of multivariate time series data as part of the anomaly detection metric; The reconstruction module is used to map the feature vector output by the correlation difference module to the latent space to capture its potential features, and then randomly sample in the latent space to obtain the reconstructed time series data; The random correlation difference module is used to capture the time dependency in the reconstructed time series data and calculate the correlation difference of the reconstructed time series data to further improve the anomaly detection and recognition ability of the model; (3) Use the multivariate time series data of the training set to train the above model, and use the reconstruction error and association difference loss as the objectives of model training; (4) Input the multivariate time series data of the test set into the trained model to obtain the corresponding association difference, and calculate the anomaly score of each time point in the multivariate time series data based on the association difference and reconstruction error; (5) Compare the anomaly score of each time point in the multivariate time series data with the set threshold. If it exceeds the threshold, it is judged as an anomaly, thereby identifying the abnormal time points in the multivariate time series data.

2. According to claim 1, a multivariate time series data anomaly detection method based on VAE and correlation difference is characterized in that: The preprocessing of multivariate time series data in step (1) includes denoising, normalization and missing value filling.

3. According to claim 1, a multivariate time series data anomaly detection method based on VAE and correlation difference is characterized in that: The multivariate time series data needs to be positionally encoded before being input into the model, that is, the multivariate time series data and the position encoding vector generated based on the sine and cosine functions are added element-wise to encode the sequential information in the data.

4. According to claim 1, a multivariate time series data anomaly detection method based on VAE and correlation difference is characterized in that: The association difference module is composed of a plurality of association difference layers in cascade. The association difference layer firstly processes the input x through Anomaly-Attention, then adds the output of Anomaly-Attention to the input x and inputs it into the feedforward neural network after layer normalization. Finally, the input and output of the feedforward neural network are added and processed by layer normalization as the output of the association difference layer.

5. According to claim 1, a multivariate time series data anomaly detection method based on VAE and correlation difference is characterized in that: The reconstruction module first uses a dimensionality reduction convolution layer to map the feature vector output by the associated difference module to the latent space to fit the mean and variance of the approximate posterior distribution of the latent variable, thereby obtaining the approximate posterior distribution of the latent variable, i.e., the latent feature, and then uses a dimensionality increase convolution layer to randomly sample in the latent space using the reparameterization technique to obtain the final latent variable as the reconstructed time series data.

6. The method for detecting anomalies of multivariate time series data based on VAE and correlation differences according to claim 1 is characterized in that: The random association difference module is composed of a plurality of random association difference layers in cascade. The random association difference layer firstly processes the input x' through Anomaly-Attention, then adds the output of Anomaly-Attention to the input x' and inputs the result into the feedforward neural network after layer normalization. Finally, the input and output of the feedforward neural network are added and input into the fully connected layer after layer normalization. The output of the fully connected layer is used as the output of the random association difference layer.

7. The method for detecting anomalies in multivariate time series data based on VAE and correlation differences according to claim 1 is characterized in that: In step (4), the anomaly score of each time point in the multivariate time series data is calculated by the following formula; ; Where: X represents multivariate time series data, Represents the reconstruction of time series data, is the anomaly score sequence of X, and each element value in the sequence corresponds to the anomaly score of each time point in the multivariate time series data; AssDis(P,S;X) is the association difference of the multivariate time series data X, To reconstruct time series data The associated difference of X and the reconstruction error consists of two parts, namely the mean square error of and KL divergence KLD, represents element-wise multiplication, and Softmax( ) represents the Softmax function.

8. The method for detecting anomalies in multivariate time series data based on VAE and correlation differences according to claim 7 is characterized in that: The expression of the association difference AssDis(P,S;X) is as follows: ; in: express Relative to The KL divergence of express Relative to The KL divergence of , L is the number of layers of the associated difference module, Represents the prior correlation matrix P l The distribution of the i-th row in , Represents the sequence correlation matrix S l The distribution of the i-th row in , where N is the sequence length of the multivariate time series data.

9. The method for detecting anomalies in multivariate time series data based on VAE and correlation differences according to claim 8 is characterized in that: The prior correlation matrix P l and the sequence correlation matrix S l The expression is as follows: ; ; Among them: Q, K, σ are query vector matrix, key vector matrix, and scale parameter matrix respectively. , , , X l is the output of the lth layer in the associated difference module input to the multivariate time series data X, , , They correspond to the weight parameter matrices of Q, K, and σ at the lth layer, σ i is the value of the i-th element in the scale parameter matrix σ, d model For X l The characteristic dimension of T Represents transpose, and Rescale() represents a rescaling operation.

10. The method for detecting anomalies in multivariate time series data based on VAE and correlation differences according to claim 1, characterized in that: The threshold in step (5) is automatically set using a super-threshold model based on extreme value theory. The super-threshold model derives the area exceeding the threshold by fitting the extreme value probability distribution of the abnormal score sequence, and deduces its tail distribution to approximately converge to the generalized Pareto distribution function according to the Pickands theorem, thereby determining the optimal threshold.

Images