Traffic time series data anomaly detection method fusing multiple mechanisms

Abstract

The invention discloses a traffic time series data anomaly detection method fusing multiple mechanisms, and relates to the technical field of data anomaly detection. Acquiring traffic time sequence data of a previous time period of the to-be-predicted time period; taking the traffic time sequence data of the previous time period as the input of a traffic time sequence data prediction model for operation, and obtaining the traffic time sequence prediction data of the to-be-predicted time period; determining a Gaussian distribution probability density value of a traffic data error value corresponding to each time point of the to-be-predicted time period based on the traffic data error value corresponding to the same time point in the traffic time sequence data of the to-be-predicted time period and the traffic time sequence prediction data of the to-be-predicted time period; and determining whether the traffic data corresponding to each time point in the traffic time sequence data of the to-be-predicted time period is abnormal or not based on the Gaussian distribution probability density value. According to the traffic time series data anomaly detection method fusing multiple mechanisms disclosed by the invention, anomaly detection can be accurately carried out on long-sequence traffic time series data.

Description

Technical Field

[0001] The present invention belongs to the technical field of data anomaly detection, and in particular relates to a traffic time series data anomaly detection method integrating multiple mechanisms. Background Art

[0002] With the development of the Internet of Things and intelligent transportation technologies, traffic time series data is increasingly being used in real life. Traffic time series data refers to chronologically arranged traffic data, such as traffic volume, speed, and lane occupancy. Detecting anomalies in this data can provide an important basis for subsequent analysis of traffic anomalies, such as congestion and accidents.

[0003] With the continuous development of deep learning methods, various deep learning algorithms have been widely used in anomaly detection of traffic time series data, such as those based on recurrent neural networks (RNNs) and long short-term memory networks (LSTMs). However, since traffic time series data contains a large amount of data over a long period of time, it is often difficult to comprehensively analyze the global and local features of long-series traffic time series data when using a single algorithm for anomaly detection. This results in poor accuracy in anomaly detection of traffic time series data.

[0004] Therefore, how to provide an effective solution to improve the accuracy of anomaly detection in traffic time series data has become an urgent problem to be solved in the existing technology. Summary of the Invention

[0005] The purpose of the present invention is to provide a traffic time series data anomaly detection method that integrates multiple mechanisms to solve the above-mentioned problems existing in the prior art.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a method for detecting anomalies in traffic time series data by integrating multiple mechanisms, including:

[0008] Obtain traffic time series data for the period before the period to be predicted;

[0009] The traffic time series data of the previous period of the time period to be predicted is used as the input of a pre-trained traffic time series data prediction model to perform calculations to obtain the traffic time series prediction data of the time period to be predicted, wherein the traffic time series data prediction model includes a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network and a long short-term memory network, the residual multi-head probabilistic sparse attention encoder is used to perform global feature extraction on the traffic time series data to obtain the global features of the traffic time series data, the multi-scale dilated convolutional neural network is used to perform multi-scale convolution feature extraction on the traffic time series data to obtain the local features of the traffic time series data, and the long short-term memory network is used to use the local features of the traffic time series data as input and the global features of the traffic time series data as the gating parameters of the input gate to perform prediction to obtain the traffic time series prediction data;

[0010] Determine the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the to-be-predicted period based on the traffic time series data of the to-be-predicted period and the traffic data error value corresponding to the same time point in the traffic time series prediction data of the to-be-predicted period;

[0011] Based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted, it is determined whether the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted has anomalies.

[0012] Based on the above disclosed content, the present invention obtains traffic time series prediction data for the time period to be predicted by taking the traffic time series data of the previous time period of the time period to be predicted as the input of a pre-trained traffic time series data prediction model, wherein the traffic time series data prediction model includes a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network and a long short-term memory network. The residual multi-head probabilistic sparse attention encoder is used to perform global feature extraction on the traffic time series data to obtain the global features of the traffic time series data, and the multi-scale dilated convolutional neural network is used to perform multi-scale convolution feature extraction on the traffic time series data to obtain the local features of the traffic time series data. The long short-term memory network is used to use the local features of the traffic time series data as input and the global features of the traffic time series data as the gating parameters of the input gate for prediction to obtain traffic time series prediction data; based on the traffic time series data of the time period to be predicted and the traffic data error values ​​corresponding to the same time point in the traffic time series prediction data of the time period to be predicted, the Gaussian distribution probability density values ​​of the traffic data error values ​​corresponding to each time point in the time period to be predicted are determined; based on the Gaussian distribution probability density values ​​of the traffic data error values ​​corresponding to each time point in the traffic time series data of the time period to be predicted, it is determined whether there is an anomaly in the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted. By adopting a common time series data prediction model that includes a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network, and a long short-term memory network, the residual multi-head probabilistic sparse attention encoder's multiple parallel self-attention heads can be used to capture different aspects of information, improving the ability to extract the overall features of time series data. The residual mechanism is used to avoid the problem of gradient vanishing during training. At the same time, the probabilistic sparse attention mechanism can perform probabilistic sparse sampling on the attention decomposition and restore the length of the original time series data through upsampling, significantly reducing computational costs while maintaining effective modeling capabilities for time series data. The multi-scale dilated convolutional neural network can obtain features at different scales by using convolution kernels of different sizes and can fuse multi-scale features. It is more robust to noise and local changes in the data, reducing the risk of overfitting of the model. The LSTM network uses a gating mechanism to overcome the vanishing gradient problem that occurs when processing long sequences of traffic time series data. The LSTM network's input gate determines how much of the current input information is stored in the cell state. The output of the self-attention mechanism assigns different degrees of attention and weight to different parts of the input, which can be used as the gating parameter of the LSTM network's input gate, thereby accelerating model convergence and increasing the model's ability to extract global feature information. In this way, the present invention can achieve rapid extraction of global features from traffic time series data while also acquiring more complex and flexible local features, enabling accurate anomaly detection in long sequences of traffic time series data.

[0013] In one possible design, the residual multi-head probabilistic sparse attention encoder is used to position-encode the traffic time series data, and then encode the data based on the residual mechanism and the multi-head probabilistic sparse self-attention mechanism to obtain a multi-head self-attention output; and

[0014] The multi-head self-attention outputs are spliced ​​to obtain the global features of the traffic time series data.

[0015] In one possible design, the multi-scale dilated convolutional neural network includes multiple convolution input channels, each convolution input channel includes four convolution kernels of different scales, and the convolution kernel scales of the four convolution kernels of different scales are 3×1×2, 3×1×4, 3×1×8 and 3×1×16, respectively.

[0016] In a possible design, when the traffic time series data prediction model is trained, the Teacher Forcing training mode is adopted in the first model training, and the Free Running training mode is adopted in the second model training.

[0017] In a possible design, the Gaussian distribution probability density value of the traffic data error value corresponding to each time point is p i =(e i -μ)∑ -1 (e i -μ) T ,in p i Represents the Gaussian distribution probability density value of the traffic data error value corresponding to the i-th time point, y i represents the traffic data corresponding to the i-th time point, represents the traffic prediction data corresponding to the i-th time point, M represents the amount of data in the traffic time series data of the period to be predicted, and T represents transposition.

[0018] In one possible design, determining whether there is an anomaly in the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted includes:

[0019] Determine whether the Gaussian distribution probability density value of the traffic data error value corresponding to each time point is higher than a preset threshold;

[0020] If the Gaussian distribution probability density value of the traffic data error value corresponding to any time point is higher than a preset threshold, it is determined that the traffic data corresponding to the any time point is abnormal.

[0021] In one possible design, each traffic data in the traffic time series data includes traffic flow data, average vehicle speed data and average lane occupancy data.

[0022] In a second aspect, the present invention provides a traffic time series data anomaly detection device integrating multiple mechanisms, including:

[0023] An acquisition unit, used to acquire traffic time series data of a period before the period to be predicted;

[0024] A prediction unit is configured to use the traffic time series data of the previous period of the time period to be predicted as input to a pre-trained traffic time series data prediction model to perform calculations to obtain traffic time series prediction data for the time period to be predicted, wherein the traffic time series data prediction model includes a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network, and a long short-term memory network. The residual multi-head probabilistic sparse attention encoder is configured to perform global feature extraction on the traffic time series data to obtain global features of the traffic time series data. The multi-scale dilated convolutional neural network is configured to perform multi-scale convolution feature extraction on the traffic time series data to obtain local features of the traffic time series data. The long short-term memory network is configured to use the local features of the traffic time series data as input and the global features of the traffic time series data as gating parameters of an input gate to perform predictions to obtain the traffic time series prediction data.

[0025] a Gaussian distribution probability density calculation unit, configured to determine a Gaussian distribution probability density value of the traffic data error value corresponding to each time point of the time period to be predicted based on the traffic time series data of the time period to be predicted and the traffic data error value corresponding to the same time point in the traffic time series prediction data of the time period to be predicted;

[0026] The anomaly detection unit is used to determine whether the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted has an anomaly based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted.

[0027] In a third aspect, the present invention provides an electronic device comprising a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the traffic time series data anomaly detection method that integrates multiple mechanisms as described in the first aspect or any possible design of the first aspect.

[0028] In a fourth aspect, the present invention provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed on a computer, the traffic time series data anomaly detection method integrating multiple mechanisms as described in the first aspect or any possible design of the first aspect is executed.

[0029] In a fifth aspect, the present invention provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the traffic time series data anomaly detection method integrating multiple mechanisms as described in the first aspect or any possible design of the first aspect.

[0030] The present invention has the following beneficial effects:

[0031] 1. By setting up a residual multi-head probabilistic sparse attention encoder, the multiple parallel self-attention heads of the residual multi-head probabilistic sparse attention encoder can be used to capture information from different aspects, improving the ability to extract the overall features of time series data. The residual mechanism is adopted to avoid the problem of gradient disappearance during training. At the same time, the probabilistic sparse attention mechanism can perform probabilistic sparse sampling on the attention decomposition and restore the length of the original time series data through upsampling, thereby significantly reducing the computational cost while maintaining the effective modeling capability of time series data.

[0032] 2. Setting up a multi-scale dilated convolutional neural network can obtain features of different scales by using convolution kernels of different sizes, and can fuse multi-scale features. It can be more robust to noise and local changes in data, reducing the risk of overfitting of the model.

[0033] 3. By setting up a long short-term memory network with a gating mechanism, the problem of vanishing gradients that occurs when processing long sequences of traffic time series data is overcome. The input gate of the long short-term memory network determines how much of the current input information is stored in the cell state. The output of the self-attention mechanism gives different degrees of attention and weight to different parts of the input, which can be used as the gating parameter of the long short-term memory network input gate, thereby accelerating the model convergence and increasing the model's ability to extract global feature information.

[0034] 4. The present invention can achieve rapid extraction of global features of traffic time series data while obtaining more complex and flexible local features, thereby accurately detecting anomalies in long sequences of traffic time series data, facilitating practical application and promotion. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flow chart of a traffic time series data anomaly detection method integrating multiple mechanisms provided in an embodiment of the present application;

[0036] Figure 2 A schematic diagram of the structure of a residual multi-head probabilistic sparse attention encoder provided in an embodiment of the present application;

[0037] Figure 3 A schematic diagram of the structure of a multi-scale dilated convolutional neural network provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of the structure of a long short-term memory network provided in an embodiment of the present application;

[0039] Figure 5 A schematic block diagram of a traffic time series data anomaly detection device integrating multiple mechanisms provided in an embodiment of the present application;

[0040] Figure 6 A schematic block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the present invention will be briefly introduced below in conjunction with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0042] It should be understood that although the terms "first," "second," etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element can be referred to as a second element, and similarly, a second element can be referred to as a first element without departing from the scope of the exemplary embodiments of the present invention.

[0043] It should be understood that the term "and / or" that may appear in this document is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B may indicate three situations: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" that may appear in this document describes another type of association object relationship, indicating that two relationships may exist. For example, A / and B may indicate two situations: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this document generally indicates that the previous and subsequent associated objects are in an "or" relationship.

[0044] In order to improve the accuracy of traffic time series data anomaly detection, an embodiment of the present application provides a traffic time series data anomaly detection method that integrates multiple mechanisms. The traffic time series data anomaly detection method that integrates multiple mechanisms can accurately detect anomalies in long sequences of traffic time series data.

[0045] The traffic time series data anomaly detection method that integrates multiple mechanisms provided in the embodiment of the present application can be applied to a user terminal or a server. It should be understood that the execution subject does not constitute a limitation on the embodiment of the present application.

[0046] The following is a detailed description of the traffic time series data anomaly detection method that integrates multiple mechanisms provided in an embodiment of the present application.

[0047] like Figure 1 As shown, it is a flowchart of the traffic time series data anomaly detection method integrating multiple mechanisms provided by the first aspect of the embodiment of the present application. The traffic time series data anomaly detection method integrating multiple mechanisms may include but is not limited to the following steps S101-S104.

[0048] Step S101: Obtain traffic time series data for the period before the period to be predicted.

[0049] The traffic time series data refers to traffic data continuously detected over a period of time. The traffic data may include, but is not limited to, traffic flow data, average vehicle speed data, and average lane occupancy data. In the embodiment of the present application, each traffic data in the traffic time series data includes traffic flow data, average vehicle speed data, and average lane occupancy data.

[0050] Step S102: Using the traffic time series data of the previous period of the period to be predicted as the input of the pre-trained traffic time series data prediction model to perform calculations to obtain traffic time series prediction data for the period to be predicted.

[0051] In an embodiment of the present application, a traffic time series data prediction model for traffic time series data prediction is pre-established. When training, the traffic time series data prediction model can use historical traffic time series data within a period of time in historical traffic data as sample input, and historical traffic time series data of the next time period of the period as sample output for training.

[0052] Among them, the traffic time series data prediction model includes the Residual Multi-head ProbSparseAttention Encoder (RMP Encoder), the Multi-Scale Dilated Convolutional Neural Network (MSD CNN) and the Long Short-Term Memory Network (LSTM). The Residual Multi-head Probability Sparse Attention Encoder is used to extract global features of traffic time series data to obtain the global features of traffic time series data. The Multi-Scale Dilated Convolutional Neural Network is used to extract multi-scale convolution features of traffic time series data to obtain the local features of traffic time series data. The Long Short-Term Memory Network is used to use the local features of traffic time series data as input and the global features of traffic time series data as the gating parameters of the input gate for prediction to obtain traffic time series prediction data.

[0053] Specifically, the residual multi-head probabilistic sparse attention encoder can be used to positionally encode traffic time series data, and then output a multi-head self-attention output based on the encoding of the residual mechanism and the multi-head probabilistic sparse self-attention mechanism; and the multi-head self-attention output is spliced ​​to obtain the global features of the traffic time series data.

[0054] In the embodiment of the present application, the residual multi-head probabilistic sparse attention encoder includes 6 layers of encoders (Encoder), and the encoders of each layer adopt the probabilistic sparse self-attention mechanism, the residual mechanism and the multi-head attention mechanism. The initial input is encoded with a sequence position dependency through position encoding, and the self-attention output is obtained through the multi-head probabilistic sparse self-attention and self-attention distillation mechanism. In order to avoid the disappearance of the gradient, residual summation and normalization can be performed. Since the self-attention distillation mechanism performs downsampling, its output does not match the original input shape, and an upsampling operation is required. Deconvolution is used to achieve upsampling. Assuming that the input length is I, the output length is O, the step size is S, and the convolution kernel size is K, the following formula can be used. Calculate the padding P. After deconvolution, it is added and normalized with the position encoding output. After passing through the feedforward network, the residual is summed and normalized again to obtain the output result of the encoder. The output result of the encoder is consistent with the input shape. In the embodiment of the present application, the residual multi-head probabilistic sparse attention encoder adopts an 8-head attention mechanism, calculates the attention results of each head according to the probabilistic sparse self-attention mechanism, and then splices the 8 attention results, and then multiplies them by the parameter matrix to obtain the final attention output result (i.e., the global features of traffic time series data).

[0055] like Figure 2 As shown, this is a structural diagram of a residual multi-head probabilistic sparse attention encoder provided by an embodiment of the present application. In the figure, the input 17856*3 indicates that the traffic time series data includes 17856 traffic data, and 3 represents data of three dimensions, namely traffic flow data, average vehicle speed data, and lane average occupancy data.

[0056] A multi-scale dilated convolutional neural network is used to perform multi-scale convolution feature extraction on traffic time series data to obtain local features of the traffic time series data. In the embodiment of the present application, the multi-scale dilated convolutional neural network includes multiple convolution input channels, each of which includes four convolution kernels of different scales. The convolution kernel scales of the four convolution kernels of different scales are 3×1×2, 3×1×4, 3×1×8, and 3×1×16, respectively.

[0057] Specifically, assume that the traffic time series data contains 17,856 traffic data points. That is, the original input is 17,856*3, the number of convolution input channels is 3, and the number of output channels is 1. Each input channel requires three convolution kernels. The multi-scale dilated convolutional neural network has four convolution kernels: filter0, filter1, filter2, and filter3, with kernel sizes of 3×1×2, 3×1×4, 3×1×8, and 3×1×16, respectively. Each convolution kernel scale corresponds to four convolution results with dilation rates: Dilation0, Dilation1, Dilation2, and Dilation3, with dilation rates of 1, 2, 4, and 8, respectively. The convolution process of filter0, filter1, filter2, and filter3 with dilation rates of 1, 2, 4, and 8, respectively, produces a total of 4×4 convolution results. Next, the 16 convolution results can be spliced ​​together using splicing technology. The size after splicing is 17856*16. After passing through the feedforward network, the output data dimension is 17856*3, which is the local feature of the traffic time series data.

[0058] See also Figure 3 , is a structural diagram of a multi-scale dilated convolutional neural network provided in an embodiment of the present application.

[0059] The long short-term memory network is used to take the local features of traffic time series data as input and the global features of traffic time series data as the gating parameters of the input gate for prediction to obtain traffic time series prediction data.

[0060] See also Figure 4 , is a schematic diagram of the structure of a long short-term memory network provided in an embodiment of the present application. Figure 4 As shown in the figure, the long short-term memory network adopts a gating mechanism to overcome the gradient vanishing problem when processing long sequences. For the acquisition of local features, a multi-scale dilated convolutional neural network (MSD CNN) is added before the long short-term memory network. The MSD convolution layer can help the long short-term memory network better extract distinguishing features. For the acquisition of local features, the global features output by the residual multi-head probabilistic sparse attention encoder (RMP Encoder) are used as the gating parameters of the input gate of the long short-term memory network after normalization. Figure 4 As shown in the figure, the input gate of the LSTM network determines how much of the current input information is saved in the cell state. The output of the self-attention mechanism gives different degrees of attention and weight to different parts of the input, which can be used as the gating parameter of the LSTM network input gate, thereby accelerating the convergence of the model and increasing the model's ability to extract global feature information.

[0061] In one or more embodiments, in order to avoid the phenomenon that prediction errors continue to accumulate and the prediction values ​​become inaccurate, when training the traffic time series data prediction model, a Teacher Forcing training mode may be adopted in the first model training, and the actual output of the training data set may be used as the input of the next time step. A Free Running training mode may be adopted in the second model training, and the output generated by the model may be used as the input, thereby increasing the robustness of the training model.

[0062] Step S103: Based on the traffic time series data of the time period to be predicted and the traffic data error value corresponding to the same time point in the traffic time series prediction data of the time period to be predicted, determine the Gaussian distribution probability density value of the traffic data error value corresponding to each time point of the time period to be predicted.

[0063] The Gaussian distribution probability density value of the traffic data error value corresponding to each time point can be expressed as p i =(e i -μ)∑ -1 (e i -μ) T ,in p i The Gaussian distribution probability density value of the traffic data error value corresponding to the i-th time point in the prediction period, y i represents the traffic data corresponding to the i-th time point, represents the traffic prediction data corresponding to the i-th time point, M represents the amount of data in the traffic time series data of the period to be predicted, and T represents transposition.

[0064] Step S104: Based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the traffic time series data of the forecast period, determine whether there is an anomaly in the traffic data corresponding to each time point in the forecast period.

[0065] In an embodiment of the present application, a preset threshold value can be set in advance for evaluating whether there is an anomaly in the traffic data. When determining whether there is an anomaly in the traffic data corresponding to each time point in the traffic time series data of the predicted period, it can be determined whether the Gaussian distribution probability density value of the traffic data error value corresponding to each time point is higher than the preset threshold value. If the Gaussian distribution probability density value of the traffic data error value corresponding to any time point is higher than the preset threshold value, it is determined that there is an anomaly in the traffic data corresponding to any time point.

[0066] In summary, the traffic time series data anomaly detection method that integrates multiple mechanisms provided by the present invention has the following beneficial effects:

[0067] 1. By setting up a residual multi-head probabilistic sparse attention encoder, the multiple parallel self-attention heads of the residual multi-head probabilistic sparse attention encoder can be used to capture information from different aspects, improving the ability to extract the overall features of time series data. The residual mechanism is adopted to avoid the problem of gradient disappearance during training. At the same time, the probabilistic sparse attention mechanism can perform probabilistic sparse sampling on the attention decomposition and restore the length of the original time series data through upsampling, thereby significantly reducing the computational cost while maintaining the effective modeling capability of time series data.

[0068] 2. Setting up a multi-scale dilated convolutional neural network can obtain features of different scales by using convolution kernels of different sizes, and can fuse multi-scale features. It can be more robust to noise and local changes in data, reducing the risk of overfitting of the model.

[0069] 3. By setting up a long short-term memory network with a gating mechanism, the problem of vanishing gradients that occurs when processing long sequences of traffic time series data is overcome. The input gate of the long short-term memory network determines how much of the current input information is stored in the cell state. The output of the self-attention mechanism gives different degrees of attention and weight to different parts of the input, which can be used as the gating parameter of the long short-term memory network input gate, thereby accelerating the model convergence and increasing the model's ability to extract global feature information.

[0070] 4. The present invention can achieve rapid extraction of global features of traffic time series data while obtaining more complex and flexible local features, thereby accurately detecting anomalies in long sequences of traffic time series data, facilitating practical application and promotion.

[0071] See also Figure 5 In a second aspect, an embodiment of the present application provides a traffic time series data anomaly detection device integrating multiple mechanisms. The traffic time series data anomaly detection device integrating multiple mechanisms includes:

[0072] An acquisition unit, used to acquire traffic time series data of a period before the period to be predicted;

[0073] A prediction unit is configured to use the traffic time series data of the previous period of the time period to be predicted as input to a pre-trained traffic time series data prediction model to perform calculations to obtain traffic time series prediction data for the time period to be predicted, wherein the traffic time series data prediction model includes a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network, and a long short-term memory network. The residual multi-head probabilistic sparse attention encoder is configured to perform global feature extraction on the traffic time series data to obtain global features of the traffic time series data. The multi-scale dilated convolutional neural network is configured to perform multi-scale convolution feature extraction on the traffic time series data to obtain local features of the traffic time series data. The long short-term memory network is configured to use the local features of the traffic time series data as input and the global features of the traffic time series data as gating parameters of an input gate to perform predictions to obtain the traffic time series prediction data.

[0074] a Gaussian distribution probability density calculation unit, configured to determine a Gaussian distribution probability density value of the traffic data error value corresponding to each time point of the time period to be predicted based on the traffic time series data of the time period to be predicted and the traffic data error value corresponding to the same time point in the traffic time series prediction data of the time period to be predicted;

[0075] The anomaly detection unit is used to determine whether the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted has an anomaly based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted.

[0076] The working process, working details and technical effects of the traffic time series data anomaly detection device integrating multiple mechanisms provided in the second aspect of this embodiment can be found in the first aspect of the embodiment and will not be repeated here.

[0077] like Figure 6 As shown, the third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the traffic time series data anomaly detection method that integrates multiple mechanisms as described in the first aspect of the embodiment.

[0078] For example, the memory may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out memory (FIFO) and / or first-in-last-out memory (FILO), etc.; the processor may be but is not limited to a microprocessor of the STM32F105 series, an ARM (Advanced RISC Machines), an X86 or other architecture processor, or a processor with an integrated NPU (neural-network processing units); the transceiver may be, but is not limited to, a WiFi (Wireless Fidelity) wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee protocol (a low-power local area network protocol based on the IEEE802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver and / or a 5G transceiver, etc.

[0079] A fourth aspect of this embodiment provides a computer-readable storage medium storing instructions for the method for detecting anomalies in traffic time series data that integrates multiple mechanisms as described in the first aspect of the embodiment. Specifically, the computer-readable storage medium stores instructions that, when executed on a computer, execute the method for detecting anomalies in traffic time series data that integrates multiple mechanisms as described in the first aspect. The computer-readable storage medium refers to a data storage medium and may include, but is not limited to, a floppy disk, a CD, a hard disk, a flash memory, a USB flash drive, and / or a memory stick. The computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable device.

[0080] The fifth aspect of this embodiment provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the traffic time series data anomaly detection method integrating multiple mechanisms as described in the first aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0081] It should be understood that certain details are provided in the following description to facilitate a thorough understanding of the example embodiments. However, one of ordinary skill in the art will appreciate that the example embodiments can be practiced without these specific details. For example, a system may be shown in block diagrams to avoid obscuring the example with unnecessary detail. In other instances, well-known processes, structures, and techniques may be shown without unnecessary detail to avoid obscuring the example embodiments.

[0082] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A traffic time series data anomaly detection method integrating multiple mechanisms, characterized in that: include: Obtain the traffic time series data of the previous period of the period to be predicted; The traffic time series data of the previous time period of the time period to be predicted is used as the input of the pre-trained traffic time series data prediction model for operation to obtain the traffic time series prediction data of the time period to be predicted, wherein the traffic time series data prediction model includes a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network and a long short-term memory network, the residual multi-head probabilistic sparse attention encoder is used to perform global feature extraction on the traffic time series data to obtain the global features of the traffic time series data, the multi-scale dilated convolutional neural network is used to perform multi-scale convolution feature extraction on the traffic time series data to obtain the local features of the traffic time series data, and the long short-term memory network is used to use the local features of the traffic time series data as input, and the global features of the traffic time series data as the gating parameters of the input gate for prediction to obtain the traffic time series prediction data; Based on the traffic time series data of the time period to be predicted and the traffic data error value corresponding to the same time point in the traffic time series prediction data of the time period to be predicted, determine the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted; Based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted, it is determined whether the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted is abnormal.

2. The traffic time series data anomaly detection method integrating multiple mechanisms according to claim 1 is characterized in that: The residual multi-head probabilistic sparse attention encoder is used to positionally encode the traffic time series data, and then output a multi-head self-attention output based on the encoding of the residual mechanism and the multi-head probabilistic sparse self-attention mechanism; as well as The multi-head self-attention outputs are spliced ​​to obtain the global features of the traffic time series data.

3. The traffic time series data anomaly detection method integrating multiple mechanisms according to claim 1 is characterized in that: The multi-scale expanded convolutional neural network includes multiple convolution input channels, each convolution input channel includes 4 convolution kernels of different scales, and the convolution kernel scales of the 4 convolution kernels of different scales are 3×1×2, 3×1×4, 3×1×8 and 3×1×16 respectively.

4. The traffic time series data anomaly detection method integrating multiple mechanisms according to claim 1 is characterized in that: When the traffic time series data prediction model is trained, the Teacher Forcing training mode is adopted in the first model training, and the Free Running training mode is adopted in the second model training.

5. The traffic time series data anomaly detection method integrating multiple mechanisms according to claim 1 is characterized in that: The Gaussian distribution probability density value of the traffic data error value corresponding to each time point is p i =(e i -μ)∑ -1 (e i -μ) T ,in p i Represents the Gaussian distribution probability density value of the traffic data error value corresponding to the i-th time point, y i represents the traffic data corresponding to the i-th time point, represents the traffic prediction data corresponding to the i-th time point, M represents the amount of data in the traffic time series data of the time period to be predicted, and T represents transposition.

6. The traffic time series data anomaly detection method integrating multiple mechanisms according to claim 1 is characterized in that: The determining whether the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted is abnormal based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted includes: Determine whether the Gaussian distribution probability density value of the traffic data error value corresponding to each time point is higher than a preset threshold; If the Gaussian distribution probability density value of the traffic data error value corresponding to any time point is higher than a preset threshold, it is determined that the traffic data corresponding to the any time point is abnormal.

7. The traffic time series data anomaly detection method integrating multiple mechanisms according to claim 1 is characterized in that: Each traffic data in the traffic time series data includes traffic flow data, average vehicle speed data and lane average occupancy rate data.

8. A traffic time series data anomaly detection device integrating multiple mechanisms, characterized in that: include: An acquisition unit, used to acquire traffic time series data of a period before the period to be predicted; A prediction unit, used for taking the traffic time series data of the previous time period of the time period to be predicted as the input of the pre-trained traffic time series data prediction model to perform operation, so as to obtain the traffic time series prediction data of the time period to be predicted, wherein the traffic time series data prediction model comprises a residual multi-head probabilistic sparse attention encoder, a multi-scale dilated convolutional neural network and a long short-term memory network, the residual multi-head probabilistic sparse attention encoder is used for performing global feature extraction on the traffic time series data to obtain the global features of the traffic time series data, the multi-scale dilated convolutional neural network is used for performing multi-scale convolution feature extraction on the traffic time series data to obtain the local features of the traffic time series data, the long short-term memory network is used for taking the local features of the traffic time series data as input, and the global features of the traffic time series data as the gating parameters of the input gate for prediction, so as to obtain the traffic time series prediction data; A Gaussian distribution probability density calculation unit is used to determine the Gaussian distribution probability density value of the traffic data error value corresponding to each time point of the time period to be predicted based on the traffic time series data of the time period to be predicted and the traffic data error value corresponding to the same time point in the traffic time series prediction data of the time period to be predicted; The anomaly detection unit is used to determine whether the traffic data corresponding to each time point in the traffic time series data of the time period to be predicted has an anomaly based on the Gaussian distribution probability density value of the traffic data error value corresponding to each time point in the time period to be predicted.

9. An electronic device, characterized in that: It includes a memory, a processor and a transceiver which are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the traffic time series data anomaly detection method integrating multiple mechanisms as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or the instruction is executed by a computer, the method for detecting anomalies in traffic time series data integrating multiple mechanisms as described in any one of claims 1 to 7 is implemented.

Images