Time-frequency-space feature fused unstable time sequence anomaly detection method and device, computer readable storage medium and electronic equipment

Abstract

The invention relates to an unstable time sequence anomaly detection method fusing time-frequency-space features. The method comprises the following steps: carrying out data preprocessing on time sequence samples in a training set; extracting time domain features, frequency domain features and space domain features; the time-frequency-space features are converted to the same dimension through transformation, splicing operation is carried out, and fusion features are obtained; calculating an abnormal score based on a reconstruction and prediction mode; constructing an error sequence based on the abnormal score, smoothing the error sequence, and calculating a dynamic threshold value by using a mean value and a standard deviation; when anomaly detection is carried out, window division is carried out on test data, then a trained model is input, an anomaly score is calculated, and whether the test data is abnormal or not is judged according to a dynamic threshold value. According to the method, complex modes and dynamic changes in the data can be more comprehensively captured and understood, abnormal conditions are effectively detected, the accuracy and reliability of abnormal detection are improved, and powerful support is provided for guaranteeing safe operation of a civil aviation system.

Description

Technical Field

[0001] The present application belongs to the technical field of multivariate time series anomaly detection, and in particular, relates to a method, device, computer-readable storage medium, and electronic device for detecting anomalies in unstable time series that integrate time-frequency-space features. Background Art

[0002] Real-time monitoring of the operation status of civil aviation systems is a key link in maintaining aviation safety. In daily operations, various core application systems generate a large amount of key time series performance indicator data, such as CPU utilization, memory usage, etc. Traditional anomaly detection methods mainly rely on manual monitoring of the changing trend of a single indicator, but this method often fails to fully consider the complex interactions between multiple indicators. With the expansion of system scale and the surge in the amount of monitoring data, traditional methods face challenges in both efficiency and effectiveness.

[0003] Currently, anomaly detection methods are mainly divided into two categories: machine learning and deep learning. Traditional machine learning methods usually rely on a lot of feature engineering in application, which involves extracting features based on statistical methods (such as principal component analysis). This method often relies on knowledge and manual experience in specific fields. Therefore, when faced with complex abnormal patterns, it may be difficult to find appropriate feature representations. In addition, for the task of anomaly detection of time series data, traditional machine learning methods are difficult to fully mine and utilize time series information and capture time dependencies, which to a certain extent limits its application in the field of time series anomaly detection.

[0004] In deep learning methods, anomaly detection of multivariate time series usually only considers time domain information, ignoring the complex interrelationships that may exist between multiple variables, such as spatial correlation (such as sensor layout) or other types of dependencies. In some cases, anomalies will show specific patterns in space. If only time domain information is considered, it is easy for anomaly detection algorithms to fail to accurately capture such patterns.

[0005] In addition, during the data collection process, we often face the problem of time drift, which causes the data distribution to change over time, posing a complex challenge. Current methods may have difficulty accurately identifying anomalies in this situation, increasing the risk of misjudgment. This time drift phenomenon requires anomaly detection methods to not only adapt to the immediate state of the data, but also to its dynamic changes to ensure long-term accuracy and reliability. Summary of the invention

[0006] After discovering the above problems, the applicant conducted an in-depth study on the existing time series anomaly detection methods. The study found that when dealing with time series anomaly detection, the existing methods usually only focus on time domain information and ignore the complex relationships that may exist between multiple variables. This approach leads to insufficient feature extraction because the interdependence and interaction between variables are not fully utilized, thus affecting the accuracy and efficiency of anomaly detection. In practical applications, especially in complex environments such as civil aviation systems, the relationships between various indicators and variables often play a key role. Ignoring these relationships may cause important abnormal patterns to be missed, thereby reducing the overall effect of anomaly detection. Therefore, in order to improve the accuracy and efficiency of anomaly detection, it is necessary to develop a new time series anomaly detection method that can comprehensively consider time domain information and the complex interactions between multiple variables.

[0007] Furthermore, in view of the high requirements of the civil aviation system for safety and detection accuracy, as well as the complexity of abnormal situations, in order to enhance the detection capability of the detection system and improve the detection efficiency and accuracy, the applicant has deeply analyzed the characteristics of the time series data of the civil aviation system. The time series data of the civil aviation system not only contains rich time domain characteristics, but also has significant frequency domain and air domain characteristics. The time domain reflects the law of change of data over time, the frequency domain reveals the periodicity and oscillation pattern of the data, and the air domain involves the relationship and distribution characteristics between multiple variables. Based on this concept, this application comprehensively considers and integrates information from different domains (trends, seasonality and statistical characteristics in the time domain, frequency components and oscillation patterns in the frequency domain, and feature combinations and interactions between variables in the air domain) to deeply model the time series of the civil aviation system, allowing joint analysis and judgment of multiple key performance indicator sequences. Through the above design, the method of this application can more comprehensively capture and understand the complex patterns and dynamic changes in the data, thereby effectively detecting abnormal situations and providing more comprehensive detection results. Through this method of integrating multi-dimensional features, we can improve the accuracy and reliability of anomaly detection, thereby providing stronger support for ensuring the safe operation of the civil aviation system.

[0008] In summary, this application enhances the information extraction capability and improves the reliability of system detection by utilizing the time-frequency-space information in multivariate time series data. This application method can quickly locate the key subsystem where the problem is based on the calculation results, and take timely intervention measures. In the future, this application method can also be integrated into the big data analysis platform and integrated with other monitoring indicators to build a more comprehensive and intelligent operation status management system, significantly improving the stability and safety of the civil aviation system.

[0009] In order to achieve the above objectives, this application provides the following technical solutions:

[0010] The first aspect of the present application provides a method for detecting anomalies in unstable time series by integrating time-frequency-space features, comprising:

[0011] Perform data preprocessing on the time series samples in the training set;

[0012] Extract time domain features, frequency domain features and spatial domain features from the preprocessed training sample data, and perform time-frequency-spatial feature modeling based on the extracted features;

[0013] The time domain features, frequency domain features and spatial domain features extracted in the previous step are converted to the same dimension through transformation, and then concatenated to obtain fused features;

[0014] Based on the reconstruction plus prediction method, the anomaly score is calculated by comparing the differences between the reconstructed data and the predicted data with the preprocessed training sample data;

[0015] Construct an error sequence based on the anomaly score, smooth the error sequence using an exponentially weighted moving average, and then use the mean and standard deviation to calculate the dynamic threshold;

[0016] When performing anomaly detection, first divide the test data into windows, then input the trained model, calculate the anomaly score, and determine whether the test data has anomalies based on the dynamic threshold determined in the previous step.

[0017] Optionally, in the method of the present application, the data preprocessing includes:

[0018] Step 11: Fill in missing data values: fill in missing data values ​​for time series samples in the training set by linear interpolation;

[0019] Step 12: Eliminate outliers: Use the SR algorithm to transform the time series samples to obtain a saliency map, detect outliers in the samples through the saliency map, and replace the outliers with normal values;

[0020] Step 13: Drift adaptive window processing: divide the time series samples into local windows, with the division step length being the window length, and perform Min-Max normalization operation in each divided window to obtain a normalized window.

[0021] Optionally, in the method of the present application, the step of extracting time domain features, frequency domain features and spatial domain features from the preprocessed training sample data includes:

[0022] Step 21, time domain feature extraction: use the long short-term memory network LSTM model to extract time domain features from the pre-processed training sample data;

[0023] Step 22, frequency domain feature extraction: use discrete wavelet transform to extract frequency domain features of the pre-processed training sample data;

[0024] Step 23: Spatial feature extraction: Use the GATv2 model to extract spatial features from the preprocessed training sample data.

[0025] Optionally, in the method of the present application, step 21 further includes: re-dividing the divided window obtained in step 13 with a step length of 1, with the window length unchanged, as the input of the LSTM model;

[0026] Through the memory unit and gating mechanism inside the LSTM model, time information is selectively retained to obtain time domain features.

[0027] Optionally, in the method of the present application, step 22 also includes: using discrete wavelet transform to extract frequency domain features of the preprocessed training sample data, and according to the transformation characteristics of the discrete wavelet, corresponding the frequency components to specific time positions, wherein the low-frequency part contains the basic characteristics of the sample, and the high-frequency part contains the details of the sample.

[0028] Optionally, in the method of the present application, step 23 also includes: using the GATv2 model, treating each variable in the training sample as a node, and the relationship between the variables as an edge, to establish a graph structure; at the same time, considering the possible changing relationship between the nodes, GATv2 calculates the attention score of each node through dynamic attention, first connecting adjacent query nodes, and then using linear transformation to calculate the relationship between the nodes to ensure a better fit to the training sample.

[0029] Optionally, in the method of the present application, the reconstruction plus prediction method calculates the anomaly score by comparing the difference between the reconstructed data and the predicted data and the preprocessed training sample data, including:

[0030] Reconstructing data with time-frequency-space information using the fusion features, comparing the reconstructed data with the preprocessed training sample data, and obtaining a reconstruction anomaly score;

[0031] Using the fusion features to make predictions for a specific time step, the predicted data is compared with the preprocessed training sample data to obtain a predicted anomaly score;

[0032] The reconstructed anomaly score and the predicted anomaly score are added in a specific ratio to obtain the anomaly score of the overall data.

[0033] The second aspect of the present application provides an unstable time series anomaly detection device integrating time-frequency-space features, comprising:

[0034] Data preprocessing module: used to perform data preprocessing on time series samples in the training set;

[0035] Feature extraction module: used to extract time domain features, frequency domain features and spatial domain features from the pre-processed training sample data, and perform time-frequency-space feature modeling based on the extracted features;

[0036] Feature fusion module: used to transform the time domain features, frequency domain features and spatial domain features into the same dimension, perform splicing operations, and obtain fusion features;

[0037] Anomaly score calculation module: used to calculate the anomaly score based on the reconstruction plus prediction method by comparing the differences between the reconstructed data and the predicted data and the preprocessed training sample data;

[0038] Dynamic threshold calculation module: used to construct an error sequence based on the anomaly score, smooth the error sequence using exponentially weighted moving average, and then calculate the dynamic threshold using the mean and standard deviation;

[0039] Anomaly detection module: used to perform anomaly detection. First, the test data is divided into windows, and then the trained model is input to calculate the anomaly score, and the dynamic threshold is used to determine whether the test data has anomalies.

[0040] The device implements the steps of the aforementioned unstable time series anomaly detection method integrating time-frequency-space features when running.

[0041] A third aspect of the present application provides an electronic device, comprising: a memory and a processor;

[0042] Memory: used to store computer programs;

[0043] Processor: used to execute the computer program to implement the steps of the aforementioned unstable time series anomaly detection method integrating time-frequency-space features.

[0044] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the aforementioned unstable time series anomaly detection method integrating time-frequency-space features are implemented.

[0045] In summary, this application proposes a new unstable time series anomaly detection method that integrates time-frequency-space features. Different from the traditional single-dimensional analysis method, this method belongs to a multivariate time series anomaly detection method. This method adopts a unique multi-dimensional data fusion strategy that combines time domain, frequency domain and space domain features, so that the system can more comprehensively capture and understand complex data patterns; in addition, the construction of the anomaly score in this method combines the reconstruction and prediction of the data. The anomaly score is calculated based on the accuracy of the reconstruction and the accuracy of the prediction: if a data point has a large deviation from the actual value when reconstructed or predicted, then this data point is considered to have a high anomaly score. This method provides a new perspective for anomaly detection of time series, which is particularly suitable for civil aviation systems with complex and dynamically changing data, and provides strong technical support for improving system safety and operational efficiency.

[0046] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the techniques indicated in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A design architecture diagram of an unstable time series anomaly detection method that integrates time-frequency-space features provided in one embodiment of the present application.

[0049] Figure 2 This is an overall implementation flow chart of an unstable time series anomaly detection method integrating time-frequency-space features provided in an embodiment of the present application.

[0050] Figure 3 A structural diagram of the composition of an unstable time series anomaly detection device integrating time-frequency-space features provided in one embodiment of the present application.

[0051] Figure 4 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0053] As used herein, the term “including” and its variations are open inclusions, ie, “including but not limited to”; the term “based on” means “based at least in part on”; and the term “one embodiment” means “at least one embodiment”.

[0054] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0055] It should be noted that the defects existing in the above-mentioned prior art are the results obtained by the applicant after practice and careful research. Therefore, the discovery process of the above-mentioned problems and the solutions proposed in the embodiments of the present application below for the above-mentioned problems should all be the original contributions made by the applicant.

[0056] Figure 1 The figure shows the design architecture of an unstable time series anomaly detection method integrating time-frequency-space features proposed in this application; Figure 2 The figure shows the overall implementation process of the anomaly detection method.

[0057] See also Figure 1 and Figure 2 , the method of this embodiment includes the following steps:

[0058] Step S1, data preprocessing.

[0059] In this step, data preprocessing is performed on the time series samples with a discrete time length of N and a variable dimension of D in the training set. The preprocessing step includes:

[0060] Step S11, fill in missing values. Fill missing values ​​of the collected multivariate time series samples by linear interpolation. Assume that the i-th variable is at the t-th time point There are missing values. Find two adjacent time points a and b with known values ​​in this variable. The corresponding known values ​​are and Then use formula (1) to solve

[0061]

[0062] Step S12, outlier removal. Due to abnormal conditions such as measurement errors and equipment failures, values ​​that deviate significantly from other observed values ​​may be generated. This application uses the SR algorithm to transform each variable of the time series data to obtain a significance map to detect significantly deviated values ​​in the sample. The specific formula of the algorithm is as follows:

[0063]

[0064] L(f)=log(A(f))#(4)

[0065] AL(f)=h q (f)·L(f)#(5)

[0066] R(f)=L(f)-AL(f)#(6)

[0067]

[0068] Among them, f represents the frequency information after Fourier transform, represents the Fourier transform operation, Amplitude(.) represents the extraction of the amplitude spectrum in the frequency domain signal, Phrase(.) represents the extraction of the phase spectrum in the frequency domain signal, log(.) represents the logarithmic operation, h q (.) represents the filter function, represents inverse Fourier transform, exp(.) represents exponential function, i represents imaginary unit, ||.|| represents L2 norm, A(f), P(f), L(f), AL(f), R(f), S(x), etc. all represent the results of related operations. Specifically, the input x is a single variable time series data, which is first transformed by Fourier transform. After that, the amplitude spectrum A(f) and phase spectrum P(f) are calculated respectively, and then the logarithm of the amplitude spectrum A(f) is taken to obtain L(f), and then L(f) is mean filtered. q (f) and then get the result AL(f). R(f) is the residual spectrum, and then perform an inverse Fourier transform The above operation can effectively detect the anomalies in the training set and replace the outliers with normal values ​​to eliminate or reduce the outliers, which can reduce the negative impact of data analysis and modeling, and improve the accuracy and reliability of data analysis.

[0069] Step S13, drift adaptive window. In the process of time series sample collection, as the collection time goes by, there is a situation where the data distribution changes due to external factors, that is, the time drift problem. To this end, the present application performs local window division on the time series samples in the preprocessing stage, and the division step is the window length. If the window length is set to t, then a total of N / t windows are divided, where the single window data Where i represents the i-th variable, t0 represents the current time window starting from t0, Represents t time points in the window. Then, the Min-Max normalization operation is performed in each divided window. The specific formula is as follows:

[0070]

[0071] Among them, x max and x min is the maximum and minimum value of the window, and x represents all the data in the current window, so that the normalized window is obtained. The above operation eliminates the influence of time drift while retaining the sample information.

[0072] Step S2: time-frequency-space feature modeling.

[0073] In this step, feature extraction is performed on the preprocessed data, and the feature extraction includes:

[0074] Step S21, time domain feature extraction. In order to extract time domain features from training samples, this application uses a long short-term memory network LSTM to make full use of the time domain information contained in the training samples. Among them, the divided window data obtained in step S13 is re-divided with a step size of 1, that is, it contains a total of N-t+1 windows, and the window length is still t, as the input of the LSTM model, the specific formula is as follows:

[0075] i t =σ(W i ˙[h t-1 ,x t ]+b i )#(9)

[0076] f t =σ(W f ˙[h t-1 ,x t ]+b f )#(10)

[0077]

[0078] o t =σ(W o ˙[h t-1 ,xt ]+b o )#(12)

[0079]

[0080] h t =o t *tanh(C t )#(14)

[0081] Among them, ˙ represents the dot product, [] represents the concatenation of two vectors, and h t-1 is the hidden state of the previous time step, x t represents the input of the current time step, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, W i , W f , W C , W o are the weight matrices of the input gate, forget gate, candidate state, and output gate, respectively, and b i , b f , b C , b o are the bias vectors of the input gate, forget gate, candidate state, and output gate, respectively, i t is the input gate, f t For the Gate of Forgetfulness, Update candidate values ​​for memory, o t As the output gate, we get the long memory C t , short memory h t , which is the feature output. Through the above-mentioned memory unit and gating mechanism inside LSTM, time information is selectively retained to obtain time domain features.

[0082] Step S22, frequency domain feature extraction. This application uses discrete wavelet transform to extract the frequency domain information contained in the training sample, and can also correspond the frequency component to a specific time position according to its transformation characteristics, where the low-frequency part contains the basic characteristics of the sample and the high-frequency part contains the details of the sample. Here, the Haar wavelet basis is used, and the specific formula is as follows:

[0083] a j [n] = ∑ k h[k]·x[(2n-k)mod t]#(15)

[0084] d j [n] = ∑ k g[k]·x[(2n-k)mod t]#(16)

[0085] Where j represents the level of wavelet transform, n represents the discrete time point on the time axis, h[k] and g[k] are the corresponding low-pass filter coefficients and high-pass filter coefficients in the Haar wavelet basis, and mod represents the modulus operation, which is used to calculate the low-frequency coefficients a and b respectively. j and high frequency coefficient d j , x is the window data obtained by S13, t is the window length, and (2n-k) mod t is used to deal with boundary effects and ensure the periodicity of the signal. In the wavelet decomposition of each layer, the low-frequency coefficient a j Represents the approximate part of the signal, the high frequency coefficient d j Represents the details of the signal. By repeatedly applying the above formula, multi-layer wavelet decomposition can be performed to obtain frequency components of different scales.

[0086] Step S23: Spatial feature extraction. This application uses the GATv2 model to establish a graph structure, treating each variable in the training sample as a node, and the node is represented as d is the feature dimension, D is the number of variables, and the relationship between the variables (h i ,h j ) is regarded as edge e, and the graph representation G = {χ, E} is obtained. Considering the possible changing relationship between nodes, GATv2 calculates the attention score of each node through dynamic attention. Compared with the original GAT model, it first connects the adjacent query nodes, and then uses linear transformation to calculate the relationship between nodes to ensure better fit to the training samples. The specific formula is as follows:

[0087] e(h i ,h j )=a T LeakyReLU(W·[h i ||h j ])#(17)

[0088] in, and It is the model parameter that can be adaptively learned during the gradient back propagation process. d′ represents the hidden layer dimension, d represents the feature dimension, LeakyReLU is the activation function, and || represents the concat operation to represent the two nodes h i ,h j After calculating the score e for node i and all neighboring nodes, the softmax operation is used for normalization:

[0089]

[0090] Where exp represents the exponential function, χ iare all neighbor nodes of node i. Then, GATv2 uses the normalized attention coefficient a ij Calculate the weighted average of the transformed features of the neighboring nodes and use a nonlinear σ operation as the new representation of node i:

[0091]

[0092] in, is a learnable parameter and σ is the sigmoid activation function.

[0093] Step S3: feature fusion.

[0094] In this step, the time-frequency-space features extracted in the above step S2 are converted to the same dimension through transformation and concatenation operation is performed.

[0095] Step S4, anomaly score calculation.

[0096] The calculation of the anomaly score is based on reconstruction plus prediction. The reconstruction part uses the fusion features of step S3 to reconstruct the reconstructed data with time-frequency-space information, and compares it with the preprocessed training samples to obtain the reconstructed anomaly score. The prediction part also uses the fusion features of step S3 to predict t time steps, and compares it with the training samples to obtain the anomaly score of the prediction part. The above anomaly scores are added in proportion θ to obtain the anomaly score of the overall data:

[0097]

[0098] Among them, t0 represents the starting point of the window, t represents the length of the time window, and represents the true value of the point, and Represents the corresponding reconstruction result and prediction result. The first half is based on the anomaly score obtained by reconstruction, and the second half is based on the anomaly score obtained by prediction. In this way, N / t error sequences are obtained, that is, α={α1,α2,…,α N / t}.

[0099] Step S5: dynamic threshold selection.

[0100] Dynamic threshold selection is suitable for data streams with different attributes and different ranges from multiple measurement points. The automatic threshold method is used to solve the diversity, non-stationarity and noise problems. Specifically, the anomaly score is measured at each time step to obtain an error sequence, and then the error sequence is smoothed using the exponentially weighted moving average (EWMA) to suppress possible error peaks and obtain the smoothed error sequence α*={α*1,α*2,…,α* N / t}. Then the threshold determination begins, specifically using the mean and standard deviation to dynamically calculate the threshold:

[0101] ε=μ(α*)+zσ(α*)#(21)

[0102] Among them, z is the coefficient, which indicates the degree to which the standard deviation σ(α) deviates from the mean μ(α), and the ε threshold is determined by these two. This function also adjusts the anomaly score for larger α a Values ​​and sequences α seq Punishment:

[0103]

[0104] Δμ(α*)=μ(α*)-μ({α∈α*|α<ε})#(23)

[0105] Δσ(α*)=σ(α*)-μ({α∈α*|α<ε})#(24)

[0106] α a ={α*∈α*|α*>ε}#(25)

[0107] α seq =continous sequences ofα*∈α a #(26)

[0108] Among them, μ(.) represents the calculated mean, σ(.) represents the calculated standard deviation, Δμ(α*) represents the mean of α* minus the mean of the error sequence of all points judged as normal values, Δσ(α*) represents the standard deviation of α* minus the standard deviation of the error sequence of all points judged as normal values, α a Indicates the number of outliers in the sequence, α seq Indicates the number of continuous sequences of outliers. In this way, the minimum number of outlier sequences and outlier points can be used to make the mean and standard deviation of the sequence after outliers removed as large as possible compared with the original sequence.

[0109] Step S6, abnormality detection.

[0110] When performing anomaly detection on the test data, the test data is first divided into windows, and then the trained model is input to calculate the anomaly score α, and then it is determined whether the sequence has an anomaly based on the threshold ε determined in step S5.

[0111] Figure 3 The present invention provides an unstable time series anomaly detection device integrating time-frequency-space features, including:

[0112] Data preprocessing module: used to perform data preprocessing on time series samples in the training set;

[0113] Feature extraction module: used to extract time domain features, frequency domain features and spatial domain features from the pre-processed training sample data, and perform time-frequency-space feature modeling based on the extracted features;

[0114] Feature fusion module: used to transform the time domain features, frequency domain features and spatial domain features into the same dimension, perform splicing operations, and obtain fusion features;

[0115] Anomaly score calculation module: used to calculate the anomaly score based on the reconstruction plus prediction method by comparing the differences between the reconstructed data and the predicted data and the preprocessed training sample data;

[0116] Dynamic threshold calculation module: used to construct an error sequence based on the anomaly score, smooth the error sequence using exponentially weighted moving average, and then calculate the dynamic threshold using the mean and standard deviation;

[0117] Anomaly detection module: used to perform anomaly detection. First, the test data is divided into windows, and then the trained model is input to calculate the anomaly score, and the dynamic threshold is used to determine whether the test data has anomalies.

[0118] When the above device is running, the steps of the unstable time series anomaly detection method integrating time-frequency-space features disclosed in this application are implemented.

[0119] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the device, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the specified function or operation, or can be realized by a combination of special hardware and computer instructions.

[0120] like Figure 4 As shown, the embodiment of the present application also discloses an electronic device, including: a processor 310, a communication interface 320, a memory 330 for storing a computer program executable by the processor, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 runs the executable computer program to implement the steps of the unstable time series anomaly detection method integrating time-frequency-space features.

[0121] It is understandable that, in addition to the memory and the processor, the electronic device may also include an input device such as a keyboard, an output device such as a display, and other communication modules. The input device, the output device, and other communication modules communicate with the processor via an I / O interface (i.e., an input / output interface).

[0122] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0123] Furthermore, the present application also discloses a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the various steps of the unstable time series anomaly detection method integrating time-frequency-space features disclosed in the present application.

[0124] In the context of the present application, a computer-readable storage medium may be a tangible medium, more specific examples of which would include a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0125] In particular, according to an embodiment of the present application, the process described in the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the unstable time series anomaly detection method integrating time-frequency-space features disclosed in the present application. When the computer program is executed by a processing device, the above functions defined in the method of the embodiment of the present application are executed.

[0126] Although several specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present application. The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solutions formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above public concept.

[0127] Those skilled in the art should also understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting anomalies in unstable time series by integrating time-frequency-space features, characterized in that: The method comprises: Perform data preprocessing on the time series samples in the training set; Extract time domain features, frequency domain features and spatial domain features from the preprocessed training sample data, and perform time-frequency-spatial feature modeling based on the extracted features; The time domain features, frequency domain features and spatial domain features extracted in the previous step are converted to the same dimension through transformation, and then concatenated to obtain fused features; Based on the reconstruction plus prediction method, the anomaly score is calculated by comparing the differences between the reconstructed data and the predicted data with the preprocessed training sample data; Construct an error sequence based on the anomaly score, smooth the error sequence using an exponentially weighted moving average, and then use the mean and standard deviation to calculate the dynamic threshold; When performing anomaly detection, first divide the test data into windows, then input the trained model, calculate the anomaly score, and determine whether the test data has anomalies based on the dynamic threshold determined in the previous step.

2. The method according to claim 1, characterized in that The data preprocessing includes: Step 11: Fill in missing data values: fill in missing data values ​​for time series samples in the training set by linear interpolation; Step 12: Eliminate outliers: Use the SR algorithm to transform the time series samples to obtain a saliency map, detect outliers in the samples through the saliency map, and replace the outliers with normal values; Step 13: Drift adaptive window processing: divide the time series samples into local windows, with the division step length being the window length, and perform Min-Max normalization operation in each divided window to obtain a normalized window.

3. The method according to claim 2, characterized in that The extracting of time domain features, frequency domain features and spatial domain features from the pre-processed training sample data includes: Step 21, time domain feature extraction: use the long short-term memory network LSTM model to extract time domain features from the pre-processed training sample data; Step 22, frequency domain feature extraction: use discrete wavelet transform to extract frequency domain features of the pre-processed training sample data; Step 23: Spatial feature extraction: Use the GATv2 model to extract spatial features from the preprocessed training sample data.

4. The method according to claim 3, characterized in that Step 21 also includes: re-dividing the divided window obtained in step 13 with a step length of 1, with the window length unchanged, as the input of the LSTM model; Through the memory unit and gating mechanism inside the LSTM model, time information is selectively retained to obtain time domain features.

5. The method according to claim 3, characterized in that: Step 22 also includes: using discrete wavelet transform to extract frequency domain features from the preprocessed training sample data, and according to the transform characteristics of discrete wavelet, mapping the frequency components to specific time positions, wherein the low-frequency part contains the basic features of the sample and the high-frequency part contains the details of the sample.

6. The method according to claim 3, characterized in that Step 23 also includes: using the GATv2 model, treating each variable in the training sample as a node, and the relationship between the variables as an edge, to establish a graph structure; at the same time, considering the possible changing relationship between the nodes, GATv2 calculates the attention score of each node through dynamic attention, first connecting the adjacent query nodes, and then using linear transformation to calculate the relationship between the nodes to ensure a better fit to the training sample.

7. The method according to claim 1, characterized in that The reconstruction plus prediction method calculates the anomaly score by comparing the differences between the reconstructed data and the predicted data and the preprocessed training sample data, including: Reconstructing data with time-frequency-space information using the fusion features, comparing the reconstructed data with the preprocessed training sample data, and obtaining a reconstruction anomaly score; Using the fusion features to make predictions for a specific time step, the predicted data is compared with the preprocessed training sample data to obtain a predicted anomaly score; The reconstructed anomaly score and the predicted anomaly score are added in a specific ratio to obtain the anomaly score of the overall data.

8. An unstable time series anomaly detection device integrating time-frequency-space features, characterized in that: The device comprises: Data preprocessing module: used to perform data preprocessing on time series samples in the training set; Feature extraction module: used to extract time domain features, frequency domain features and spatial domain features from the pre-processed training sample data, and perform time-frequency-space feature modeling based on the extracted features; Feature fusion module: used to transform the time domain features, frequency domain features and spatial domain features into the same dimension, perform splicing operations, and obtain fusion features; Anomaly score calculation module: used to calculate the anomaly score based on the reconstruction plus prediction method by comparing the differences between the reconstructed data and the predicted data and the preprocessed training sample data; Dynamic threshold calculation module: used to construct an error sequence based on the anomaly score, smooth the error sequence using exponentially weighted moving average, and then calculate the dynamic threshold using the mean and standard deviation; Anomaly detection module: used to perform anomaly detection. First, the test data is divided into windows, and then the trained model is input to calculate the anomaly score, and the dynamic threshold is used to determine whether the test data has anomalies.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the unstable time series anomaly detection method integrating time-frequency-space features as described in any one of claims 1 to 7 are implemented.

10. An electronic device, characterized in that: include: Memory and processor; Memory: used to store computer programs; Processor: used to execute the computer program to implement the steps of the unstable time series anomaly detection method integrating time-frequency-space features as described in any one of claims 1-7.

Images